From 993a9238289aa672b26ae22f70a6920acd88e212 Mon Sep 17 00:00:00 2001 From: qi4L Date: Tue, 13 Aug 2024 10:52:53 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8Dhessian?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gradle/8.7/checksums/checksums.lock | Bin 17 -> 17 bytes .../8.7/executionHistory/executionHistory.bin | Bin 2055431 -> 2055431 bytes .../executionHistory/executionHistory.lock | Bin 17 -> 17 bytes .gradle/8.7/fileHashes/fileHashes.bin | Bin 165883 -> 165883 bytes .gradle/8.7/fileHashes/fileHashes.lock | Bin 17 -> 17 bytes .../8.7/fileHashes/resourceHashesCache.bin | Bin 105439 -> 105575 bytes .../buildOutputCleanup.lock | Bin 17 -> 17 bytes .gradle/file-system.probe | Bin 8 -> 8 bytes .../qi4l/jndi/gadgets/utils/Serializer.java | 4 +++- 9 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.gradle/8.7/checksums/checksums.lock b/.gradle/8.7/checksums/checksums.lock index 94f2169dc17a2410c52a4b00befada1b13503d91..16d9d4dbc221c27855cc3f5486a16704e7297768 100644 GIT binary patch literal 17 VcmZRU*k4$1@M75u1~6cH2LL#b1)Kl? literal 17 VcmZRU*k4$1@M75u1~6cH1pqjV1(*N; diff --git a/.gradle/8.7/executionHistory/executionHistory.bin b/.gradle/8.7/executionHistory/executionHistory.bin index bbe63304f834e74fc290627eef0458cf005b8435..3433798707802522e055dad51136080ce9af2786 100644 GIT binary patch delta 5167 zcmb`LX;f5Kw#Pki&aLZJsiL4jKoF480g7@Wc2scA;A~u(Y#TK%YMjt$zc>Q|0)isS zMiH4*91ua!Qqc%FD(VM4|4*c|6{+Xf zS**LUY~zOqpqCi~Nwyr*)E?1?t480zlxV9@)?Mx~0x z1QW}Gl2W@4ux=JN%Ew7O843}8vRSF2Un^`_5!gR%XM$os*%h2;bAzN=;I5zS3Bys4 z>&Ugb5487}1EuTq3x@j3?<@C-;}wdJ&W{Hoe_kbS~D?yV~#dknnO z1v|Nq^u6=AzpxU1KaY16RfPJlc^7e-u)m6D31@%JdrIe3w7`U}avxDg@}sZ0zw#Z) zKe^%~XXU~Xg64Cha-GE6wkSriHjeODRlGssqc&^;e8Tv`X6GxDX5OMYSLbt2QBU}0KCX<%l&HZQvp3#hjxcfoH;SiZ|DOeXjP#7` z5E&#pxQ?qI`&n?cB_gc)m!aoBIQF8EY-iL?j2`RS9`*;}3T@H?YJ%hd@tpDu`#bL| zz0l--!E$G*MdMk)vY!-PN;9z$S&1b+;KtG+Vz6R@JHePQQFC||EPF~x8oQh2uF`6a zN1A0XWexF)whSQG&dv$em@#mz=CB>NE!1bEWLNHL{ZF-ggsgiJpHQ#Wfl%Y9% z79x9#4JyNhZ+ItZqbBbPkvoYTl06sV*2^XNlpSup#%kdKfflU2PxB48;6Anz7aOn! ztHBy~7vl3fK;pA@80GcC)&=IwbQj>d2tw6&zW_X+Z-a>Dvv?Xdor-LZqG zNQ7nG{agXMd~x7ur-qegn@VEl5-@B``Tzh^L%8+DL`y7Z$K zTdc-DBwpvB#Tx#}bkMBEJ|ex`py}pN*+u-MN)R4}!+Jv2MuXaA6Wl#*(m{F@Mm-}v z+os}C_fzi?232FoFbPyVitKy|9!^mhJB7Px^jpkjHGW9sL zz#!aI_om>cx`3|AuaqHK$2O&<#=3zNgW>rU;~vAiiLF|u7(PglCuGEMKj}3EL0uo& zSG*yQr!hQ0{6^@ug8PW&Woi!wt-#Z81>qbO;|MpQgFbsRHXeQ_ElK3@M5kVbkA)+84E}c0@KsCB*1P#FXbKK% zdaHR9cg1ZGdDiF(e~-lxB~#&)SRO1=2&-bT52=)_)LA|8I^!YB~3**9RcBx zI2=y~;cQhcA>0^;r*xT$mLKe~*1a06^`n|#KiS{J;W>YhuxmUI6o&{ujpyFtFkw_Y z_Mk#VORPJ?CEm`)0jlD07LJp+(+frWbaw~mR)**g?mt=Ff)fP=V3crJnaNH z9Yg4`iVqdBgwt1HKjR29R`K3)vWk`y<6zA|xx08snf1v$SZbi^@OB_x1Wz;$9wY}y zO&U)aB=;6i=>_6$GEQzOt!*U*v!_t@&=kDh_mes;g%6UpYjMj8S&)>kan4{lNXa6; zuER->xai^lzZEj0l1*Zb1yADeQ%=s{F$9OTMHON3Y962zkiFR+?Gg5pGb~l@g=D{l zc2PvwdJPYhR?`5XaR^R%D)nsQ8s1&Xp$ss3sN6#kL){uY>T)%?VyNsRsFz?)<=v#U zT9V*B%wMEYlGUj=Xblgh;@Vh8>YY?vM(fErU*IlH-KaRF7c-+sC-VnuvG0e~Ik8;! zXC<)uh`SlL=$h{`j+VQ0Dx4J(THSBdrIQ;d!3l+JgL{+ge226$+|K8XQ{%smnH`>G zag2K}HiJA~w_&McznD8MV#c(EU(5}fJR@S>yjBL?w1IzXs(=hyf*$EobxIy=dgewqL z!UCjxihw;Ote;e%@!j|3ca>elQ4V;kRZg?>feCwY@P(=fFV^uMx@@wyz@EL#)2*2% zJAR;TD}zVq!lMp(U%BQtoqw;#66c4|u$OsBMOtS2Qr5|>ggB)WI)^SepKP`>dIn}C z=yShM{|rW!GC%3C=DbMdBN`W!GJmN;WMFTvGlac z<0jZM0&n*Q(oVbMTcFnir}pr2A0~UO1=;OqeWXT>N9<<k8i!a}hUL3||Q{e&WOjdp_TJ?M*??J}J}d3d!$47GBv! zglsd%rA8re^dR#Udq^I$nGeyGk$ex#hgf^CZpLkJfRtZhqN+SVMLtMMdRth1h;;zh zZ0sRP5S)!uS5C=3&*sCFqvV+T7d*8hpSnB4iENy@<7B^;jq`Pe&?g6Hv6^s94tAkV zivsgu<_ZUMF#AO^*5u&5dx`K>4(~5tCcl@hA#A+t(`w&OM&WjyJb zZSlXZ{VcsZe2k(X5oT}07r~XP9dftvQ3|2uJC1KXl|vm|q1Q3orHK>|BaShjaoRS1 z#PBFW5x`{OSW0ZnpDb(Q$V0-)Bvq z6Kt93=ev5-n=cQoENYJVAg`~(mb`KtO#JR09Gk!qi!ki=SC;oJQg4f4loBj_MB~+&22O;_r zl|9)m%EtP*)OF>D>5Gir|L?D7R{VPA$gFvKkN^L=rs02jcGkK`eaj*+EOBe&IsWmE i@|Kx<9uHnVrC)@92lJh)YjL?(UE4f_vsSius{RF}L*nfK delta 5168 zcmcJTX;@U(8OJ$t?w#wXFboW7C~>W(v6d{Y8W+%Ls~8oPMHGZ! zcu`OmL8C?XIBpnmNi*v#;-nM(#QUO00|_{{M6Lzn1gT^L{a#+(^;2hz3& z%&xmOF;8B-EY`d%mL)27V>UIo)U_{wyZ0iBe@=A%vNAV*Qa{j5a_nbbexyghH0kC? z?Kvj%-`%Y9n3R4Cf28pWX66+=UQ2xOf8_k}=%PsunZd>*HqT0|e}ACQd7bXplG(FO z9(&My{gQS0RGnwp&kuH;Jv}A&-0l1of!PnCrB&kr5mP0t`JKBOVCLyV_?JU3>1!I*xJ3S(1+%)bDUm-fQ4FwMz$3ILDDyYAY$r6= zN&zrr01jJ-J9@DSh^&)>APGf@L}*o=PLWfUo^6GeddVGr>h7Pukb7%dsDCvK55gk9 zpxSE}@-F;(As;AxMXK$)JV2WI;zwx>&}zhZ7K4XI#j}guLzIE?cHtNoqIhWquj$PIN^EQ# zAv**ecM5|K(LmlM_>AhfTQCbn$4cVuwk#iVWXTD#mvFsYEe!q;s(4E^D#Mv2yuVy4 zDz-R(^itN=e+VAM=Y_-Ws^>*luBQ#1Zp*^}+mq8H@!A5mpRV21(ygw0X<;FqzN< zKMYnzbg^-W5~UTo*_PGjmMjW|$|1OqgjV9hc7WGRS3l@f#SR+m0hyIUj$1Du2nqYQ z_*lnwK~9+B1-jX;3M|4NS(rm+nDRmwH-{-kiF9aO&O?=(6tU6(;upC`+XL)!a`OPS7$!@s&1Eg4?TkfRs(>wubvyFlr5+h8syu=*B`c(B`YEX_HPZ zM(Tk(d<_;O#0@UEdy`Ezj<|%qCd_#KS*$$m&FGFE9)6#gwvyW|jd~T{lpN4v)S<$$ z>)-pV!_9B;U1P-EUxY>VK->n2pXpuUuPHbp5+N&v8!dPw1#8$w!RnmU6K?<>vOE<{ zNd&i4ypBGk%A-?pJObyd>L;XbPQ_FD1O@ok4s*3PVXp7g03^bbR6Ozp4ou^L7JMy@ zdrQp}AUO>yxJUs~+}TEG?9;;@j-=r%d`aRiFBI+a-0hvLbgRbv^VYJUbB#q!(qDYP z`|xNhMNrbYuO!f<;XY#@UeP2%$2wfz z0zKCA7^#4~X0OLO1?I2kLzQ9*aC{PEk5mRrloD(+xlvw49q`LYya>_+8>5r}dA;E2 zQOZzhCtZ|nnK-$0j)OJ}qf(t)ou#tFF^Z2x4$0wzx`G(1n7<{+h8!I9 z4s|YIUki2FA8WrzC*|kFb{W)uOAYuR>af5XN%+DfA#%ptY2W8nQ91h@q2zZ;kXHOE*Q$GZ z3oe*nusVy_Y+z-%IeYuV^EFH_SJLYaM2=P*;YKdkX=+LM0+MT3fLt$DK~)WVQ8o*1 z8?8LAJw%*rkGERmEE^w~UW=!H)@%eETVy39qaEVIIBMz-`>69&|d#ctC}~y(Kl!GjfS{7<|m&PWhDIv z@2F$`@>!ubzM}Zcmj$zWHoS`?>X~mBzf;fp%jxudAbG43(W{;8J1z`io1t@n>;jMK zacZuKD7ueWXcxzPgqb>p9zRYoYVQ-D_hNaujmHd7H4bn0N2Hx_$G1SQtB%g_;3Ew7 zSUB12VI$-5-O-KbRf8R>npc4RL@)?ZTcL`k1O0Hn z-syC-hXn05Z9hE&rbu$!Pb8kUdFm~pl0 z^<5XA>tmw(@Ar397ptLiRIfFmJ_eaGI2# zV1}w(MMY^MC9gMZ*w6ZcYY|pR5*Ukc>dsKQ*Nb?pwwVk|p2Jfs@wU4Y952GDJ5T+W zi*UZaCiE%BS!^SmP>dxIno1z#AajL%#TdPVI-82|-WB+;n7^dlQdQG~o)9rb@o{?1 z@vBjuxBoVdP3wDVd3{iGC-pW$Rs-|EcYhqnT~hL)dJ6tiJ%Nh!km6n`;jtDRP>T1) z6H*tK;hWEX| z_--|88(tFY$o6B^K;RGC@EH=CjzPp>9QN=sEKhWfE8}reHo26R;TbIOR2e?b&7>O2 zajFSTnfCZk+UsTeevn#@D@lm=;c%lmljS%E#j1ztDBNje?r;kgMJP}4{kELjLx>jN zZ~JY>Q3}1FH~!bPn`i3|Q&E&ig!$X?MNnYLcK)iijDnu!_}0@HWA6&#M{$>ylL+IE zGM`Ce$6jZ6l=b{zz_lMg44NJox$Z{C+m#2^({1}tQPE2)e%gH`VAQ_Jm&#DuyYi{S z;|EXu{**l>>+#uy7f`wyG(4r@!=}e(kIey_0h=Q>Cv48xT+F+7x|W`c{2!l`n#K;lnc*=tdRpwd zlzWq(^f{5ubidZDj^lTi-UHJjW+>)}89iG*HfO%zes0BY?ovo-a6kT=`xCsTO69+~ zDWNeJzX;K%sG>J*l6#nM*14v?l9!|({NKNxnepqH12dP}di);}8^-?T>6u#+ZJ#B9 r?mf3&o^LGW&wFqs*Ie8h&6$;T>ydu}>uX>( diff --git a/.gradle/8.7/executionHistory/executionHistory.lock b/.gradle/8.7/executionHistory/executionHistory.lock index b537e7009ffcf2c0fa6dda334b3f239455d5e66b..6fc733c5e2728ca3a24064dc8ba540f5a54f4f05 100644 GIT binary patch literal 17 UcmZQ>dGjUQrSpIr0|e9p06U=t4*&oF literal 17 UcmZQ>dGjUQrSpIr0|b-<06Uun2><{9 diff --git a/.gradle/8.7/fileHashes/fileHashes.bin b/.gradle/8.7/fileHashes/fileHashes.bin index 3e9857b9248fa1378cb2638e000d33b232098a93..e5549ddb211c2b35905baf867b9c262ca4ae3485 100644 GIT binary patch delta 3660 zcmY+GdsI}{6~>*bhy+pTn5ttaD6zyBW+DiPfQV=S5e5P0&S(K21!4$6qQ>A9Mg)A6 zB2MV%BZLg-vQ~|;kxo-&sWH}AqXZ*KsiB5NT$n^fs3dU_wddTu!&;rcezPCne%y2J zx&u{D4OBfHCqXk)PQq>MhbFJxRMUjVnvTpL5f}myoo766mWzC>ZKmmv;Q=9 z2)~Rxk0z!MahK^M_y&`=9VVtOOuwx&pf*?;E7Q8sNDkEl-5jzHH$oHxX3wFJ!$_Dz zD&NA!bO0xqYSGE`mLvmahEUpm#D-{T>T}q{Gz~|Xrpp?#adif~LW!m#iYX8UOu-mE zO|;t_s)?#0XcG>xFm(a#!>z$FgN!2r|Cm>Et&uONfzRa7$-;5^fM^b3;W zh5R^!9nLI07R)2<*PzZLonq`_+KOhTGW0O*#H0v{+vR9lW0_XM7VtBE_ATtZx}tFLe3$Y=|dDUeS|}T9qmtegd(zAhTu5UFx+Gs4(}JWEX#1jFpa;vK!M?Ro+`|l9lrPr%?t>Osi1Jv>J^}Ytb!8PGO@d zez~2N6O=?#6eA&tgi2szvf~6(DLR?Tpiic_a>O!KViQv~jxfE18%%ldGEv5QL=l*r|AG+=Wo)tQ89VV67f=aVp$cKDxE?Rr}Fka>6p zqSuK7GA4~0cOW2*^c+x`-lRA0p)``NK{Gr4h#n&KG$y4hhVdN@!+LWnUMtOyu6qIf5rIynGWI(6d2 zH$>)sOkA$n%s(KJ$kKpfro%YNbQE2JXnPZ`uZI zHdDoSag^yKI+#v7dTR`rs?rjg5v@|}SriJAwLT_QxA#z;ECxBNQn5>99)6VG<$b~| zt6heNMN?2WBAm$b8S zQx{4K4gYqw)`oQ_8na2hAKgUOU6_zVwq7LUh-1_9)##^x%KrQIcl%2d>Lc_A>0qp^ zhb>3R6ty$s(McJZ=b+Ekax=el#pWs&op774qTwaYD5#C8)#biU+3G1*@d%Y0sooQu zA+jpyWpac6Ce3SgM;g;uR4_e_517W|JEmvg^EzetAc@Hjc0qCxlV}km&%$0HF4oo8 zX%YUo#i3I$ZZoC-8gWG85Erp60LKUECet){zd;$(5yLbC8<>J{m?;$POkv0uHx5&Z zw9{%0Lqrh?gd?9R3Qnel_)L)OJ&t-Gx0HJK+d{oBLC6+LHzAj484fU|;tErmqx$y- zOt4YWNT1hJF&6eElE)|K@dz6)J)M17i4@4gdfE delta 3661 zcmZ9Pdr*|;6~@_*;3a^CK^l~0$MdqDYobP&f%R*`G+6p@|^RY z_c9;DwNDP$K3RFpWV2bbdhRxEot{}+e&JF3r@KG;#LLT67aTG%-^=)!Sn0Oan`<`O zOrDK4ZI<>#aA;vVYUgQlb=rtiM1H!B!?g^gEY-}I5U!aybY?gQB@1R{A$I&m8g=>+T1@oTckUS(l$13lj zTor)42NlGD1dUD07hRKsZeukfEg8W$_n3#ZU!ObnrRJLa?KWn3bM zKCo*%4{JSoGfZa8h~k0WL{t>3-9)~kX)9X#?tIRM$lE7)qd6696F&r1-&R%0d zg!~nXq!?D4iwdD<(JExaKoU)Fgo1sk@t<4IMEI?^2 z3$K8)ibPIRIGs9s8m@~Y4HIABkW9o0tw)ifcZu|Qt>*&1J5ZNI_v8KxTww#o$8q`w zEL2pW=%Aurp*(mm;*2~*D9R<$%g8PBFF@}gE$`SOE|Z7PBy0-^2iHOJ2QFcM31%;0r4p=Fv`-Pu#eyp;_#Qd*UMr=T6DePk zT1>oV{+@aKG^8Yu+3|no7UTVBCab;?)%ZA`OYd=a@3p|^MQ&*?roL#{3%4Vg$-WmZ zp#}JpqT9+lc_}OHb=#^eczG!+)uK%7`*B3*4ct%^_%qHrfW?Zo2{q!7qAQAgmvKfT zqJ>&uSJXtLkKsL@j*qX~w9AZdmhpPugHHncKV`rFLp05%1C^S<0bSTk0s3gVjDfT# z@G`n^Zq$zd3iZI2$gzLN%S3wFt1KJv2jtM5#)pY4djn@A^aj2Yx`jE*Ieik=E2?1fVHVxN=#=<{^GyD+C zRCpLpCi@Dsh}VisMEao9WPhE;{?16{IUh$QtW95i}@Aw<1#-2Oq~g zp_AAobP8Z{SaDX-uz1@Lnl6Rhy)Ri%n$C6FP)ByX!8SPw-aNxE(v9osu(EkfHsbQ> zfCQ}K(ONNU6%Sw*vJ@FF@4KrEX-5b;#1Vo)CVM8PXK0om6s^9n?`~N_^Hs0g6Na2C zZN@i9C}l)jOcv{3`YyMgKRRPe_ut~O3$pJ1R=i={iEk8gV(FpyeFk?D22Tce5{9pt z3jc_p)rPIG4M|Lna8w9IqE#pcUlQpjD2B!T=ev8in(=HVFJ4LpRT$O{WTl(t2t;Wn zSB$~?imnSKx$o6mFguHfkc7A_j!i`okzQ*Z*Yf!gbt`EhompH=%wyi?xBNbt^=j)d zevP4EABTlZjvN#S<>H{CULsxJ!TK}a;%~Dbu4VmgY!0~ScI`J~C0TX(66CJs26y01 zpj`Mk-P9UwEWUA5?vD7?-`q~{l-`C+>L$3T<-urQFKqJ0YBQ# z-Uh4^I)oZU9}9heyF#s)TEZEvNLJ(`(s$`29)w>fTu!=J=Sz4$Jh&~P9!xIfbPtvZ zg`-U9B#tP$p(t<%XPm@hp-yZQ>cSzRbGRaO9(KBMm|4cB^*o}>SfCqrp&m2|UBu@^ zdhcIw?~_+>@7A5%`%Ogd^4M;I4bkf+^)(bO^R`mc7ri{s)W``s;F5 z{TB7)*Ei@}oDuqu=eu%kNZ(YaF9s?Mw=)3KDn}_r$bu>&{oq+xeEdFl&RR2iDve7q zYF+pcy=k-ynv0L46;oU+WksT*az#f+$w&kRgIHncHfU}{g_*M9#v U+d}Uj{c}hUGtbT^o_^2$A6I_y-2eap diff --git a/.gradle/8.7/fileHashes/fileHashes.lock b/.gradle/8.7/fileHashes/fileHashes.lock index a9fa3832b743fc0e2310ef299df36ed293394d71..4ea3ab2076b90c2a862035c63850ca04593a5344 100644 GIT binary patch literal 17 VcmZR+d$zvH^H97W0~m{%DkhNX@>#ePb=7Gz;Ux ujfw^0+vmthE11h4^S diff --git a/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java b/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java index c013798..87d7c1d 100644 --- a/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java +++ b/src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java @@ -51,12 +51,14 @@ public class Serializer implements Callable { NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory(); sf.setAllowNonSerializable(true); AobjOut.setSerializerFactory(sf); + AobjOut.writeObject(obj); + AobjOut.close(); }else { objOut = new ObjectOutputStream(out); } if (IS_Hessian1 || IS_Hessian2) { - AobjOut.writeObject(AobjOut); + AobjOut.writeObject(obj); } else { objOut.writeObject(obj); }